CVE-2026-105860: Payload has a tenant authorization bypass in Multi-Tenant Plugin

October 7, 2026

When using the default tenant array field access, an authenticated user could assign themselves to other tenants.

You are affected if:

You are using @payloadcms/plugin-multi-tenant

If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior.

References

github.com/advisories/GHSA-p96c-xwx8-3cqj
github.com/payloadcms/payload/commit/19b58692d20d3947f31124bf7a88ac14a5ebf02e
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-p96c-xwx8-3cqj
nvd.nist.gov/vuln/detail/CVE-2026-105860

Code Behaviors & Features

Detect and mitigate CVE-2026-105860 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →