CVE-2026-34751 PUBLISHED

Payload has Unvalidated Input in Password Recovery Endpoints

Assigner: GitHub_M
Reserved: 30.03.2026 Published: 01.04.2026 Updated: 01.04.2026

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	payloadcms
Product	payload
Versions	Version < 3.79.1 is affected

References

Problem Types

CWE-472: External Control of Assumed-Immutable Web Parameter CWE
CWE-640: Weak Password Recovery Mechanism for Forgotten Password CWE