An attacker can exploit unvalidated input in the password recovery endpoint of Payload CMS, prior to version 3.79.1 of @payloadcms/graphql and payload, to perform privileged actions without authentication. The flaw allows a remote user to initiate and control a password reset for any account, thereby enabling the attacker to act as the victim and gain full access to the system’s data and capabilities. This reflects a critical input‑validation omission, corresponding to CWE‑472 and CWE‑640.

Payload CMS, using @payloadcms/graphql and payload packages, is affected in all releases prior to 3.79.1. Any installation running those versions exposes the vulnerable password recovery flow until upgraded.

The CVSS base score of 9.1 indicates a high severity issue. Although no EPSS score is available and the vulnerability is not listed in CISA KEV, the flaw remains likely to be abused. Exploitation demands only access to the publicly exposed password‑reset endpoint; no credentials or additional privileges are required, making the attack vector straightforward for an unauthenticated adversary.