CVE-2026-34751
Critical · 9.1CVSS
9.1
EPSS
0.4%
Published
Apr 1, 2026
CISA due date
—
The record
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @payloadcms/graphql | 0 | 3.79.1 |
| npm | payload | 0 | 3.79.1 |
Related vulnerabilities
- GHSA-hp5w-3hxx-vmwf Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery Same vulnerability
- GHSA-p6mr-xf3r-ghq4 Payload has a CSRF Protection Bypass in Authentication Flow Also affects payload
- GHSA-6r7f-q7f5-wpx8 Payload has Authenticated SSRF via Upload Functionality Also affects payload
- GHSA-7xxh-373w-35vg Payload has an SQL Injection via Query Handling Also affects payload
- CVE-2026-34749 Payload is a free and open source headless content management system. Also affects payload
- CVE-2026-34746 Payload is a free and open source headless content management system. Also affects payload
- CVE-2026-34747 Payload is a free and open source headless content management system. Also affects payload
- GHSA-hhfx-5x8j-f5f6 Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads Also affects payload