A Cross-Site Request Forgery vulnerability in Payload CMS allows an attacker to forge requests against the authentication flow when the CSRF protection is misconfigured or bypassed. The exploit can execute actions that the authenticated user is authorized to perform, potentially leading to unauthorized data modification or other unintended behavior. The weakness is identified as a CSRF flaw.

All Payload CMS installations running a version older than 3.79.1 are affected. The vulnerability is present in the default Payload product distributed by payloadcms:payload.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector, inferred from the description, involves an attacker sending crafted HTTP requests to the authentication endpoints of a web application where a victim is already logged in. Because CSRF exploits rely on the victim’s authenticated session, successful execution would allow the attacker to perform privileged actions as that user.