Vulnerabilities in pkg:npm/@payloadcms/plugin-multi-tenant
PACKAGECVE-2026-105860 is a HIGH payload has a tenant authorization vulnerability (CWE-862: Missing Authorization) affecting @payloadcms/plugin multi tenant libraries in the npm ecosystem. The issue involves payload has a tenant authorization bypass in multi-tenant plugin. Remediation is available by upgrading affected packages to version 3.90.0, 4.0.0-canary.34.
pkg:npm/@payloadcms/plugin-multi-tenant
Vulnerability advisories affecting package pkg:npm/@payloadcms/plugin-multi-tenant. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-p96c-xwx8-3cqj | CVE-2026-105860 | HIGH | Payload has a tenant authorization bypass in Multi-Tenant Plugin |
| GHSA-xhm9-gwgw-3q2q | CVE-2026-105864 | MODERATE | @payloadcms/plugin-multi-tenant has a cross-tenant create issue |
CVE-2026-105860 at a Glance
How to Fix CVE-2026-105860
To remediate this vulnerability, upgrade all affected @payloadcms/plugin multi tenant dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @payloadcms/plugin-multi-tenant@3.90.0npm install @payloadcms/plugin-multi-tenant@4.0.0-canary.34Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @payloadcms/plugin-multi-tenantHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-105860, inspect your project dependencies using npm:
npm ls @payloadcms/plugin-multi-tenantAnalyze the terminal output to locate any version of @payloadcms/plugin multi tenant in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.90.0), your application is affected.
Note: The npm ls @payloadcms/plugin-multi-tenant command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-862: Missing Authorization, where the product does not perform an authorization check when an actor attempts to access a resource or perform an action. In @payloadcms/plugin multi tenant, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-105860 Affected @payloadcms/plugin multi tenant Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@payloadcms/plugin-multi-tenant
|
npm |
< 3.90.0
|
3.90.0
|
|
@payloadcms/plugin-multi-tenant
|
npm |
≥ 4.0.0-canary.0
< 4.0.0-canary.34
|
4.0.0-canary.34
|
References
Frequently Asked Questions
What is CVE-2026-105860?
Which @payloadcms/plugin multi tenant versions are affected?
What version fixes CVE-2026-105860?
Is @payloadcms/plugin-multi-tenant affected?
What CWE is associated with CVE-2026-105860?
How can I check npm dependencies for CVE-2026-105860?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-p96c-xwx8-3cqj",
"modified" : "2026-10-07T20:29:53Z",
"published" : "2026-10-07T20:29:53Z",
"aliases" : [ "CVE-2026-105860" ],
"summary" : "Payload has a tenant authorization bypass in Multi-Tenant Plugin",
"details" : "## Impact\n\nWhen using the default tenant array field access, an authenticated user could assign themselves to other tenants.\n\n**You are affected if:**\n\n- You are using `@payloadcms/plugin-multi-tenant`\n\nIf you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior.\n\n## Patches\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n## Workarounds\n\nConfigure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all tenants can modify memberships.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@payloadcms/plugin-multi-tenant"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "3.90.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@payloadcms/plugin-multi-tenant"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0-canary.0"
}, {
"fixed" : "4.0.0-canary.34"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/payloadcms/payload/security/advisories/GHSA-p96c-xwx8-3cqj"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-105860"
}, {
"type" : "WEB",
"url" : "https://github.com/payloadcms/payload/commit/19b58692d20d3947f31124bf7a88ac14a5ebf02e"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/payloadcms/payload"
}, {
"type" : "WEB",
"url" : "https://github.com/payloadcms/payload/releases/tag/v3.90.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-862" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-10-07T20:29:53Z",
"nvd_published_at" : "2026-10-06T17:17:22Z"
}
}