2vulnerabilities
- Critical0 (0.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
payloadcms-plugin-multi-tenant
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 2 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- 2 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting payloadcms-plugin-multi-tenant, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-p96c-xwx8-3cqj | High | Payload has a tenant authorization bypass in Multi-Tenant Plugin## Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. **You are affected if:** - You are using `@payloadcms/plugin-multi-tenant` If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds Configure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all ten |
| GitHub (opens in a new tab) | |
| GHSA-xhm9-gwgw-3q2q | Moderate | @payloadcms/plugin-multi-tenant has a cross-tenant create issue### Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using @payloadcms/plugin-multi-tenant ### Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds You can add access control with `accessResultOverride` on the multi-tenant collection config to ensure a user has access to the tenant before creating. |
| GitHub (opens in a new tab) |
- GHSA-p96c-xwx8-3cqjHighPayload has a tenant authorization bypass in Multi-Tenant Plugin
< 3.90.0>= 4.0.0-canary.0, < 4.0.0-canary.34
## Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. **You are affected if:** - You are using `@payloadcms/plugin-multi-tenant` If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds Configure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all ten
CVE: CVE-2026-105860
- GHSA-xhm9-gwgw-3q2qModerate@payloadcms/plugin-multi-tenant has a cross-tenant create issue
< 3.90.0>= 4.0.0-canary.0, < 4.0.0-canary.34
### Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using @payloadcms/plugin-multi-tenant ### Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds You can add access control with `accessResultOverride` on the multi-tenant collection config to ensure a user has access to the tenant before creating.
CVE: CVE-2026-105864