CVE-2026-34751

Published: Apr 1, 2026Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.

Affected (1)

Products: Payloadcms: Payload

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Payloadcms Payload	Before 3.79.1

Related CWEs

External Control of Assumed-Immutable Web Parameter

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (2)

https://github.com/payloadcms/payload/releases/tag/v3.79.1

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/payloadcms/payload/security/advisories/GHSA-hp5w-3hxx-vmwf

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.