CVE-2026-34751 in payload
Zusammenfassung (Englisch)
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Zuständig
GitHub_M
Reservieren
30.03.2026
Veröffentlichung
01.04.2026
Status
Bestätigt
Einträge
VulDB provides additional information and datapoints for this CVE:
| ID | Schwachstelle | CWE | Aus | Mas | CVE |
|---|---|---|---|---|---|
| 354749 | payloadcms payload Password Reset Remote Code Execution | 472 | Nicht definiert | Offizieller Fix | CVE-2026-34751 |