CVE-2026-34749

{
  "id": "CVE-2026-34749",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-01T20:16:27.187",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1."
    },
    {
      "lang": "es",
      "value": "Payload es un sistema de gestión de contenido headless de código abierto y gratuito. Antes de la versión 3.79.1, existe una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el flujo de autenticación. Bajo ciertas condiciones, la protección CSRF configurada podría ser eludida, permitiendo que se realicen peticiones entre sitios. Este problema ha sido parcheado en la versión 3.79.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "payloadcms",
          "product": "payload",
          "versions": [
            {
              "version": "< 3.79.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T14:11:02.350739Z",
          "id": "CVE-2026-34749",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "3.79.1",
              "matchCriteriaId": "B4AE65F8-450D-4573-9CD7-1AA42CE5DC28"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/payloadcms/payload/releases/tag/v3.79.1",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}