An improper authorization vulnerability (CWE-307) exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation. This flaw allows users with limited privileges to perform account unlock actions that should be restricted, potentially bypassing intended security controls. The vulnerability has been assigned CVE-2026-11779 and is rated as medium severity with a CVSS 4.0 vector indicating network attack vector, low attack complexity, no user interaction, and limited confidentiality and integrity impact. No official patch or fix has been published, and no known exploits have been observed in the wild.

The vulnerability could allow unauthorized users with limited privileges to unlock accounts without proper authorization, potentially leading to unauthorized access or abuse of account management functions. However, the impact is limited to the account unlock operation and is rated medium severity. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to account management functions to trusted users only and monitor for unusual account unlock activities.