Threats affecting pkg:npm/payload

Payload CMS versions prior to 3.73.0 contain a blind SQL injection vulnerability in the processing of 'where' filters on JSON or RichText fields using the Drizzle database adapters. This vulnerability allows attacker-controlled JSON filter input to manipulate generated JSONPath expressions, potentially exposing sensitive data. Exploit code is publicly available demonstrating this issue on Payload CMS 3.72.0 with PostgreSQL 15.

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.