The vulnerability arises because certain request inputs are not properly validated in Payload CMS, allowing an attacker to inject arbitrary SQL into database queries. This flaw can lead to the exposure or modification of data stored in collections, compromising both confidentiality and integrity of the system. The weakness corresponds to CWE‑89, SQL Injection.

Payload CMS before version 3.79.1 is affected. The issue exists in all releases of the Payload CMS product by Payload CMS that shipped prior to the v3.79.1 release.

The common vulnerability scoring system assigns a high severity of 8.5, indicating a serious risk. The EPSS score of less than 1% suggests that exploitation is currently unlikely. Because the vulnerability is not listed in the CISA KEV catalog, no confirmed widespread exploitation has been reported. Attackers would need to send crafted HTTP requests to endpoints that use untrusted input in SQL queries. The attack vector is inferred to be remote over the network, though the description does not explicitly state this. Security teams should treat this as a high‑risk issue that requires timely remediation.