En bref
- CVE-2026-34751 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant payload (payloadcms), @payloadcms/graphql, payload.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.31%, plus élevée que 24.0% des vulnérabilités.
- Correctif : mettre à jour vers 3.79.1 ou plus récent.
Description
Impact
A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.
Users are affected if:
- They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in
forgot-password functionality.
Patches
Input validation and URL construction in the password recovery flow have been hardened.
Users should upgrade to v3.79.1 or later.
Workarounds
There are no complete workarounds. Upgrading to v3.79.1 is recommended.
NVD description
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free