{"id":"EUVD-2026-17991","revision":"9ba669a23b6c4e8cb9fcd1a0c1e19223","records":[{"revision":"9ba669a23b6c4e8cb9fcd1a0c1e19223","observedAt":"2026-10-28T04:53:27.945+00:00","statement":{"source":"euvd","id":"EUVD-2026-17991","aliases":["CVE-2026-34751","GHSA-hp5w-3hxx-vmwf"],"title":"Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on be…","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":null}],"references":["https://github.com/payloadcms/payload/security/advisories/GHSA-hp5w-3hxx-vmwf","https://github.com/payloadcms/payload/releases/tag/v3.79.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-17991","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 1, 2026, 5:42:45 PM","dateUpdated":"Apr 4, 2026, 3:06:17 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-17991","identifiers":["EUVD-2026-17991","CVE-2026-34751","GHSA-hp5w-3hxx-vmwf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}