CVE-2026-105864: @payloadcms/plugin-multi-tenant has a cross-tenant create issue

October 7, 2026

An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection.

Reads and direct edits to an existing target-tenant document were not bypassed.

You are affected if:

You are using @payloadcms/plugin-multi-tenant

References

github.com/advisories/GHSA-xhm9-gwgw-3q2q
github.com/payloadcms/payload/commit/b8fc06a18afb6974dc07f95ac1e541c716e5926b
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-xhm9-gwgw-3q2q
nvd.nist.gov/vuln/detail/CVE-2026-105864

Code Behaviors & Features

Detect and mitigate CVE-2026-105864 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →