GitHub Advisoryadvisory · npm

GHSA-xhm9-gwgw-3q2q @payloadcms/plugin-multi-tenant has a cross-tenant create issue

MEDIUM Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-105864
Ecosystem
npm
Packages
@payloadcms/plugin-multi-tenant
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-863
Reviewed
2026-10-07

Affected packages

• npm @payloadcms/plugin-multi-tenant: < 3.90.0 → fixed in 3.90.0 • npm @payloadcms/plugin-multi-tenant: >= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34

Description

Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: • You are using @payloadcms/plugin-multi-tenant Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. Workarounds You can add access control with `accessResultOverride` on the multi-tenant collection config to ensure a user has access to the tenant before creating.

Related

Alias · CVE (1)

  • CVE-2026-105864 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References