Summary
Payload has a tenant authorization bypass in Multi-Tenant Plugin
Advisory details
Impact
When using the default tenant array field access, an authenticated user could assign themselves to other tenants.
You are affected if:
- You are using
@payloadcms/plugin-multi-tenant
If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Configure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all tenants can modify memberships.
References
- https://github.com/advisories/GHSA-p96c-xwx8-3cqj
- https://github.com/payloadcms/payload/security/advisories/GHSA-p96c-xwx8-3cqj
- https://nvd.nist.gov/vuln/detail/CVE-2026-105860
- https://github.com/payloadcms/payload/commit/19b58692d20d3947f31124bf7a88ac14a5ebf02e
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
- CRITICALCVE-2026-102748
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
- HIGHCVE-2026-85990
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
- HIGHCVE-2026-84315
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
- MEDIUMGHSA-3hc7-r24j-rpwc
Vikunja: Cross-project task disclosure through subtask expansion
- MEDIUMGHSA-g38j-7v97-x298
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID