En resumen
- CVE-2026-34751 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a payload (payloadcms), @payloadcms/graphql, payload.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.31%, mayor que el 24.0% de las vulnerabilidades.
- Solución: actualizar a 3.79.1 o posterior.
Description
Impact
A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.
Users are affected if:
- They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in
forgot-password functionality.
Patches
Input validation and URL construction in the password recovery flow have been hardened.
Users should upgrade to v3.79.1 or later.
Workarounds
There are no complete workarounds. Upgrading to v3.79.1 is recommended.
NVD description
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free