Advisories for Npm/@Saltcorn/Data package

2026

@saltcorn/data: Tenant user role is used for tenant creation role check

When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append /tenant/create to their tenant URL. The system reads the role from the tenant context (admin), and a new tenant is created on the root domain (in PUBLIC SCHEMA > _sc_tenants), rather than in the tenant's own _sc_tenants table. If the same logic applies …