fkie_cve-2026-105858

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

GHSA-97rh-rhh2-7vjv — Payload: Remote Code Execution through first-register

Affected: npm: payload

### Impact A crafted request to the public first-register operation can be used to perform a RCE exploit.

**You are affected if:**

- You use local auth strategy and your application remains without an initial user created

## Patches

In the patched version data submission to create first user is properly sanitized.

Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

Most recent entries from all

fkie_cve-2026-105858

GHSA-97rh-rhh2-7vjv — Payload: Remote Code Execution through first-register