CVE-2026-34751: CWE-472: External Control of Assumed-Immutable Web Parameter in payloadcms payload
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
AI Analysis
Technical Summary
CVE-2026-34751 is a critical vulnerability in the PayloadCMS headless content management system affecting versions before 3.79.1. The flaw exists in the password recovery process within @payloadcms/graphql and payload components, where an unauthenticated attacker can manipulate parameters assumed to be immutable, enabling unauthorized actions as the user who started the password reset. This vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter) and CWE-640 (Weak Password Recovery Mechanism). The vulnerability has been patched in version 3.79.1.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to perform actions on behalf of a user during the password recovery process, potentially leading to unauthorized account access or manipulation. The CVSS score of 9.1 indicates a critical severity with high confidentiality and integrity impact but no availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade PayloadCMS to version 3.79.1 or later, where this vulnerability has been officially patched. No other mitigation is required once the update is applied.
CVE-2026-34751: CWE-472: External Control of Assumed-Immutable Web Parameter in payloadcms payload
Description
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-34751 is a critical vulnerability in the PayloadCMS headless content management system affecting versions before 3.79.1. The flaw exists in the password recovery process within @payloadcms/graphql and payload components, where an unauthenticated attacker can manipulate parameters assumed to be immutable, enabling unauthorized actions as the user who started the password reset. This vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter) and CWE-640 (Weak Password Recovery Mechanism). The vulnerability has been patched in version 3.79.1.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to perform actions on behalf of a user during the password recovery process, potentially leading to unauthorized account access or manipulation. The CVSS score of 9.1 indicates a critical severity with high confidentiality and integrity impact but no availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade PayloadCMS to version 3.79.1 or later, where this vulnerability has been officially patched. No other mitigation is required once the update is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-30T19:17:10.225Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69cd5f13e6bfc5ba1de6e53d
Added to database: 4/1/2026, 6:08:19 PM
Last enriched: 4/9/2026, 10:40:16 PM
Last updated: 5/20/2026, 8:51:43 PM
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.