p PatchFirst

PatchFirst · Latest vulnerabilities

@payloadcms/plugin-multi-tenant vulnerabilities

Vulnerabilities published for @payloadcms/plugin-multi-tenant in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-105864

    Medium · CVSS 5.3EPSS 0.2%Fix available

    Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

    Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

    @payloadcms/plugin-multi-tenant @payloadcms/plugin-multi-tenantNode.js
    • Update to 3.90.0
    • Update to 4.0.0-canary.34
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-105860

    High · CVSS 7.1EPSS 0.19%Fix available

    Payload: Tenant authorization bypass in Multi-Tenant Plugin

    Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

    @payloadcms/plugin-multi-tenant @payloadcms/plugin-multi-tenantNode.js
    • Update to 3.90.0
    • Update to 4.0.0-canary.34
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →