GitHub Advisoryadvisory · npm

GHSA-p96c-xwx8-3cqj Payload has a tenant authorization bypass in Multi-Tenant Plugin

HIGH Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-105860
Ecosystem
npm
Packages
@payloadcms/plugin-multi-tenant
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2026-10-07

Affected packages

• npm @payloadcms/plugin-multi-tenant: < 3.90.0 → fixed in 3.90.0 • npm @payloadcms/plugin-multi-tenant: >= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34

Description

Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. You are affected if: • You are using `@payloadcms/plugin-multi-tenant` If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior. Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Workarounds Configure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all tenants can modify memberships.

Related

Alias · CVE (1)

  • CVE-2026-105860 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References