Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.
References
| Link | Resource |
|---|---|
| https://github.com/payloadcms/payload/releases/tag/v3.79.1 | Product Release Notes |
| https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4 | Mitigation Vendor Advisory |
Configurations
History
17 Jun 2026, 10:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4 - Mitigation, Vendor Advisory |
13 Apr 2026, 19:13
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Payloadcms
Payloadcms payload |
|
| References | () https://github.com/payloadcms/payload/releases/tag/v3.79.1 - Product, Release Notes | |
| References | () https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4 - Vendor Advisory, Mitigation | |
| CPE | cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* |
01 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-01 20:16
Updated : 2026-06-17 10:39
NVD link : CVE-2026-34749
Mitre link : CVE-2026-34749
CVE.ORG link : CVE-2026-34749
JSON object : View
Products Affected
payloadcms
- payload
CWE
CWE-352
Cross-Site Request Forgery (CSRF)