CVE-2026-105864: Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant
Published Oct 6, 2026
·Updated
Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
Affected Software
1 affected component
npm/@payloadcms/plugin-multi-tenant<3.90.0, <4.0.0-canary.34
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@payloadcms/plugin-multi-tenantto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
@payloadcms/plugin-multi-tenantto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34
Event History
Oct 6, 2026
CVE Published
via MITRE·04:42 PM
Data Sourced
via MITRE·04:42 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness