CVE-2026-105864: @payloadcms/plugin multi tenant @payloadcms/plugin-multi-tenant Has A Cross-tenant Create Vulnerability

MODERATE
Advisory Identifier: GHSA-xhm9-gwgw-3q2q
Share
CWE-863
Published
Advisory Summary

CVE-2026-105864 is a MODERATE @payloadcms/plugin-multi-tenant has a cross-tenant create vulnerability (CWE-863: Incorrect Authorization) affecting @payloadcms/plugin multi tenant libraries in the npm ecosystem. The issue involves @payloadcms/plugin-multi-tenant has a cross-tenant create issue. Remediation is available by upgrading affected packages to version 3.90.0, 4.0.0-canary.34.

CVE-2026-105864 at a Glance

CVE Identifier CVE-2026-105864
GHSA Identifier GHSA-xhm9-gwgw-3q2q
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-863: Incorrect Authorization
Affected Product @payloadcms/plugin multi tenant
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2026-105864

To remediate this vulnerability, upgrade all affected @payloadcms/plugin multi tenant dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@payloadcms/plugin-multi-tenant fixed: 3.90.0 
npm install @payloadcms/plugin-multi-tenant@3.90.0
@payloadcms/plugin-multi-tenant fixed: 4.0.0-canary.34 
npm install @payloadcms/plugin-multi-tenant@4.0.0-canary.34
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @payloadcms/plugin-multi-tenant

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-105864, inspect your project dependencies using npm:

npm ls @payloadcms/plugin-multi-tenant

Analyze the terminal output to locate any version of @payloadcms/plugin multi tenant in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.90.0), your application is affected.

Note: The npm ls @payloadcms/plugin-multi-tenant command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In @payloadcms/plugin multi tenant, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using @payloadcms/plugin-multi-tenant ### Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds You can add access control with `accessResultOverride` on the multi-tenant collection config to ensure a user has access to the tenant before creating.

CVE-2026-105864 Affected @payloadcms/plugin multi tenant Versions

2 component(s)
Fixed Versions:
3.90.04.0.0-canary.34
Product / Package Ecosystem Affected Versions Fixed Version
@payloadcms/plugin-multi-tenant
npm/@payloadcms/plugin-multi-tenant
npm
< 3.90.0
3.90.0
@payloadcms/plugin-multi-tenant
npm/@payloadcms/plugin-multi-tenant
npm
≥ 4.0.0-canary.0
< 4.0.0-canary.34
4.0.0-canary.34

References

GitHub Advisory / Wiki ADVISORY
https://github.com/payloadcms/payload/security/advisories/GHSA-xhm9-gwgw-3q2q
NVD — CVE-2026-105864 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105864
Security Fix Commit FIX COMMIT
https://github.com/payloadcms/payload/commit/b8fc06a18afb6974dc07f95ac1e541c716e5926b
@payloadcms/plugin multi tenant Source Repository REPOSITORY
https://github.com/payloadcms/payload
@payloadcms/plugin multi tenant Release RELEASE
https://github.com/payloadcms/payload/releases/tag/v3.90.0

Frequently Asked Questions

What is CVE-2026-105864?
CVE-2026-105864 is a security vulnerability in @payloadcms/plugin multi tenant involving @payloadcms/plugin-multi-tenant has a cross-tenant create issue under CWE-863: Incorrect Authorization.
Which @payloadcms/plugin multi tenant versions are affected?
Affected versions include releases prior to 3.90.0, 4.0.0-canary.34 across affected packages: @payloadcms/plugin-multi-tenant.
What version fixes CVE-2026-105864?
Upgrading to 3.90.0, 4.0.0-canary.34 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @payloadcms/plugin-multi-tenant affected?
Yes, @payloadcms/plugin-multi-tenant is affected in releases prior to 3.90.0, 4.0.0-canary.34. Upgrade your dependency to 3.90.0, 4.0.0-canary.34 or later.
What CWE is associated with CVE-2026-105864?
CVE-2026-105864 is classified under CWE-863: Incorrect Authorization (The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.).
How can I check npm dependencies for CVE-2026-105864?
Run the dependency tree command: 'npm ls @payloadcms/plugin-multi-tenant'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xhm9-gwgw-3q2q",
  "modified" : "2026-10-07T20:29:28Z",
  "published" : "2026-10-07T20:29:27Z",
  "aliases" : [ "CVE-2026-105864" ],
  "summary" : "@payloadcms/plugin-multi-tenant has a cross-tenant create issue",
  "details" : "### Impact\nAn authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection.\n\nReads and direct edits to an existing target-tenant document were not bypassed.\n\nYou are affected if:\n- You are using @payloadcms/plugin-multi-tenant\n\n### Patches\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n### Workarounds\nYou can add access control with `accessResultOverride` on the multi-tenant collection config to ensure a user has access to the tenant before creating.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@payloadcms/plugin-multi-tenant"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.90.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@payloadcms/plugin-multi-tenant"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0-canary.0"
      }, {
        "fixed" : "4.0.0-canary.34"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/payloadcms/payload/security/advisories/GHSA-xhm9-gwgw-3q2q"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-105864"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/payloadcms/payload/commit/b8fc06a18afb6974dc07f95ac1e541c716e5926b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/payloadcms/payload"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/payloadcms/payload/releases/tag/v3.90.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-07T20:29:27Z",
    "nvd_published_at" : "2026-10-06T17:17:22Z"
  }
}