@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +133 more potentially affected by CVE-2026-11779 via payload (>=0.8.2, <=4.0.0-internal.9726517)

payload NPM version =0.8.2, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.1, =1.0.1-beta.0, =1.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-11779 Source advisory: SNYK:JS-PAYLOAD-17660977...

CVE-2026-11779 PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation...