A stored Cross-Site Scripting vulnerability in Payload versions prior to 3.78.0 poses a significant risk of administrative account compromise via malicious script execution.

This is a stored Cross-Site Scripting (XSS) flaw (CWE-79) affecting the admin panel of the Payload headless CMS. The vulnerability requires an authenticated user with write access to a collection to inject malicious content that executes when viewed by other users.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an unsuspecting user's browser session. Given the CVSS score of 8.7, this is a high-severity issue that could lead to session hijacking, unauthorized administrative actions, or the theft of sensitive data. Such compromises directly threaten the integrity of the content management system and the confidentiality of administrative sessions.

Immediate Action: Update the @payloadcms/next package to version 3.78.0 or later to apply the security patch.

Proactive Monitoring: Review administrative access logs for unusual activity or suspicious content submissions within collections.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser environment.

Public Exploit Available: Unknown

The vulnerability represents a significant risk to administrative security within the Payload CMS environment. Organizations should prioritize updating to version 3.78.0 immediately to remediate the underlying XSS flaw and prevent potential session-based attacks.