CVE-2026-105860

HighCVSS 7.1

Published: 06/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The @payloadcms/plugin-multi-tenant plugin before versions 3.90.0 and canary before 4.0.0-canary.34 by default allows an authenticated user to assign their own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and update functions are not affected. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Risk Assessment

An authenticated user may gain access to other tenants, potentially leading to unauthorized data access or breach of tenant isolation.

Recommendation

Upgrade @payloadcms/plugin-multi-tenant to version 3.90.0 or 4.0.0-canary.34. If unable to upgrade, replace the default behavior with secured tenant field access functions.

Other vulnerabilities in @payloadcms/plugin-multi-tenant

CVE-2026-105864Medium
Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed.

Original NVD description (English source)

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS