A blind SQL injection flaw exists in the PayloadCMS headless content management system when querying JSON or richText fields. User-supplied input is inserted directly into PostgreSQL or SQLite SQL statements without proper escaping, allowing an attacker to reveal sensitive information such as email addresses and password reset tokens. Because the vulnerability is unauthenticated, the compromised data can be used to take over user accounts without needing to guess or crack passwords. The weakness corresponds to CWE-89, representing an injection attack.

Versions of PayloadCMS below 3.73.0 are affected. The vulnerability applies to the PayloadCMS open‑source headless CMS, which typically runs on a Node.js runtime and relies on PostgreSQL or SQLite adapters for data storage. All installations of PayloadCMS that have not upgraded past version 3.73.0 are potentially exposed.

The CVSS score is 9.8, indicating a critical severity level. However, the EPSS score is less than 1 %, implying a very low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog, but because it permits full account takeover, the impact to confidentiality, integrity, and availability is high. Attackers exploit it by sending crafted JSON or richText queries to the CMS without authenticating, extracting data and hijacking accounts through the revealed credentials.