Improper Authorization is present in PayloadCMS version 3.84.1 because the account unlock operation does not enforce sufficient access control. This flaw allows an attacker who possesses any authenticated user token to use the default unlock endpoint to unlock accounts that should remain locked. As a result, the attacker can gain unauthorized access to those accounts, facilitating account takeover or credential harvesting. The weakness is identified as CWE-307.

PayloadCMS PayloadCMS version 3.84.1 running on Linux, macOS, or Windows operating systems is affected. Only the listed version is known to contain the flaw.

The CVSS base score is 5.3, indicating a medium severity. No EPSS data is available, and the vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that the threat requires an authenticated user and can be executed remotely via the web interface. Because the flaw permits bypassing the lockout mechanism, an attacker can obtain access to user accounts and potentially compromise additional resources, depending on account privileges. Mitigation hinges on enforcing proper authorization for the unlock endpoint and patching the affected release.