CVE-2026-34749

Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/payloadcms/payload/releases/tag/v3.79.1	Product Release Notes
https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Payload es un sistema de gestión de contenido headless de código abierto y gratuito. Antes de la versión 3.79.1, existe una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el flujo de autenticación. Bajo ciertas condiciones, la protección CSRF configurada podría ser eludida, permitiendo que se realicen peticiones entre sitios. Este problema ha sido parcheado en la versión 3.79.1.

Information

Published : 2026-04-01 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34749

Mitre link : CVE-2026-34749

CVE.ORG link : CVE-2026-34749

JSON object : View

Products Affected

payloadcms

payload

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-34749", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34749", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T14:11:02.350739Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "payloadcms", "product": "payload", "versions": [{"status": "affected", "version": "< 3.79.1"}]}]}], "published": "2026-04-01T20:16:27.187", "references": [{"url": "https://github.com/payloadcms/payload/releases/tag/v3.79.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1."}, {"lang": "es", "value": "Payload es un sistema de gesti\u00f3n de contenido headless de c\u00f3digo abierto y gratuito. Antes de la versi\u00f3n 3.79.1, existe una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en el flujo de autenticaci\u00f3n. Bajo ciertas condiciones, la protecci\u00f3n CSRF configurada podr\u00eda ser eludida, permitiendo que se realicen peticiones entre sitios. Este problema ha sido parcheado en la versi\u00f3n 3.79.1."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "B4AE65F8-450D-4573-9CD7-1AA42CE5DC28", "versionEndExcluding": "3.79.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}