{"id":"EUVD-2026-18017","enisaUuid":"1b7751c3-59ad-317e-a2f8-513a312ecd76","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.","datePublished":"Apr 1, 2026, 7:49:35 PM","dateUpdated":"Apr 6, 2026, 7:46:32 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4\nhttps://github.com/payloadcms/payload/releases/tag/v3.79.1\n","aliases":"CVE-2026-34749\n","assigner":"GitHub_M","epss":0.13,"enisaIdProduct":[{"id":"880535a7-e021-37c5-9349-5074e64d97c3","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.79.1"}],"enisaIdVendor":[{"id":"8b4853df-07a4-3890-9375-4347fde7460f","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"6b66a953-75ec-3a9a-afb2-651fe7f2fd70","vulnerability":{"id":"CVE-2026-34749","description":"Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.","datePublished":"Apr 1, 2026, 7:49:35 PM","dateUpdated":"Apr 6, 2026, 7:46:32 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4\nhttps://github.com/payloadcms/payload/releases/tag/v3.79.1\n","enisa_id":"EUVD-2026-18017\n","assigner":"GitHub_M","epss":0.13,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"6da12358-a69d-325b-8a3f-9cc38c7e8528","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.79.1"}],"vulnerabilityVendor":[{"id":"314e0d8f-1034-3ec4-a97c-5fa85ee5f04d","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}