{"id":"CVE-2026-105858","published":"2026-10-06T17:17:21.847","lastModified":"2026-10-09T02:16:56.207","description":"Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94","CWE-1321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679","tags":[]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","tags":[]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv","tags":[]}],"exploitRefs":[{"url":"https://github.com/payloadcms/payload/commit/e947fc4ba4a434f276d043386e501b1d14eda679","tags":[]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.90.0","tags":[]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-97rh-rhh2-7vjv","tags":[]}],"hasPoc":true,"ai":{"summary":"A remote code execution vulnerability exists in a headless CMS where an attacker can execute arbitrary code by sending a crafted request to the public first-register endpoint when local authentication is enabled and no initial user exists. This allows full system compromise with high severity.","exploitability":"Exploitation requires a single crafted HTTP request to the public registration endpoint, but depends on specific preconditions: local authentication must be enabled and no initial user must exist in the system.","blast_radius":"The vulnerability affects installations using local authentication without an initial user account, potentially allowing attackers to gain full control over the CMS server and execute arbitrary commands with the privileges of the web application.","remediation":"Upgrade to version 3.90.0 or later, or upgrade to 4.0.0-canary.34 if using canary versions.","detection":"Monitor for unusual POST requests to the /register endpoint with malformed payloads that trigger code execution, particularly when local authentication is enabled and no initial user exists in the system logs.","tags":["rce","cms","auth","web"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:58:48.683Z"}}