What is the CVSS score of CVE-2026-58200?

CVE-2026-58200 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-58200?

Yes, a patch is available for CVE-2026-58200. Update the affected software to the latest version immediately.

Payload Plugins CVE-2026-58200

EUVD-2026-78825 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-09-15 GitHub_M

Authentication Bypass Jwt Attack Payload Plugins

7.1

CVSS 3.1 · Vendor: GitHub_M

View

Vulnerability Assessment

Weakness

CWE

CWE-347

OWASP Top 10:2025

A04:2025 - Cryptographic Failures

ASVS 5.0

V11 - Cryptography Signature verification

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Any authenticated user of a Payload CMS instance running @jhb.software/payload-cloudinary-plugin (0.3.0 through 0.3.x, fixed in 0.4.0) can obtain a cryptographically valid Cloudinary HMAC-SHA1 upload signature for parameters of their choosing, because the client-upload signing endpoint POST /api/cloudinary-generate-signature forwards attacker-controlled 'paramsToSign' straight to cloudinary.utils.api_sign_request() with no key allowlist, folder policy, or timestamp check. With that signature plus the intentionally client-visible Cloudinary API key, an attacker can overwrite existing assets, flip upload visibility with type=private, register notification_url callbacks to attacker-chosen hosts, force cache invalidation, and write files outside the intended upload folder. The issue is only reachable when the plugin's clientUploads option is enabled, and no public exploit code or active-exploitation reporting was present in the supplied intelligence.

Affected VersionsENISA

payload-plugins 0.3.0, < 0.4.0

Affected Packages

npm @jhb.software/payload-cloudinary-plugin fix: 0.4.0

euvd payload_plugins_0_3_0 fix: 0.4.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in npm, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Payload Plugins gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Sep 15, 2026 - 17:18 EUVD

CVE Published

Sep 15, 2026 - 16:27 cve.org

HIGH 7.1

DescriptionCVE.org

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes attacker-controlled body.paramsToSign directly to cloudinary.utils.api_sign_request without a key allowlist, collection policy, timestamp freshness check, or configured-folder enforcement. Any authenticated Payload user can obtain a valid Cloudinary HMAC-SHA1 signature for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder, and public_id. The signature can authorize asset replacement, upload visibility changes, callbacks to attacker-selected URLs, cache invalidation, and uploads outside the intended folder. The client-visible Cloudinary API key is expected by the upload design, but the unrestricted server-side signature supplies the authorization value needed to complete these operations. This vulnerability is fixed in 0.4.0.

Technical POC Analysis

CWE-347 (Improper Verification of Cryptographic Signature), in practice an unauthenticated-parameter signing oracle.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.