Payload CMS Password Recovery Flow Vulnerability Allowing Unauthenticated Actions on Behalf of Users

A vulnerability exists in the password recovery process of Payload CMS versions prior to 3.79.1, specifically within the @payloadcms/graphql package. This issue allows an unauthenticated attacker to perform actions on behalf of a user who has requested a password reset. The vulnerability arises from unvalidated input in the password recovery endpoints, which could be exploited to manipulate the recovery process.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of users who initiate a password reset, potentially allowing attackers to gain access to user accounts or manipulate user data.

Remediation

Users are advised to upgrade to Payload CMS version 3.79.1 or later. Instructions for updating can be found in the release notes on the Payload CMS GitHub repository.