CVE-2026-105860 payloadcms CVE debrief

Who should care

Defenders managing multi-tenant environments using @payloadcms/plugin-multi-tenant should verify exposure and prioritize upgrading to >= 3.90.0 or >= 4.0.0-canary.34. Security teams and operators should review the vulnerability details and assess the impact on their environments. Platform and vulnerability-management teams should also review the vulnerability and plan for mitigations.

Why it matters

CVE-2026-105860 allows an authenticated user to assign themselves to other tenants in @payloadcms/plugin-multi-tenant using default tenant array field access.

• Verify exposure in multi-tenant environments
• Upgrade to >= 3.90.0 or >= 4.0.0-canary.34 to prevent unauthorized tenant assignments
• Configure secured membership fields to restrict tenant modifications

Technical summary

The @payloadcms/plugin-multi-tenant is vulnerable to a tenant authorization bypass when using default tenant array field access, allowing an authenticated user to assign themselves to other tenants. This vulnerability could lead to unauthorized access and modifications. The plugin is used in multi-tenant environments, and the vulnerability can be mitigated by upgrading to >= 3.90.0 or >= 4.0.0-canary.34 or configuring secured membership fields. The vulnerability was reported by osv_dev and details can be found in the official CVE Program record and NIST NVD detail page.

Defensive priority

Defenders should prioritize verifying exposure in multi-tenant environments using @payloadcms/plugin-multi-tenant and upgrading to >= 3.90.0 or >= 4.0.0-canary.34.

Recommended defensive actions

• Verify if using @payloadcms/plugin-multi-tenant and assess exposure
• Upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34
• Configure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update for secured membership field
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerability in @payloadcms/plugin-multi-tenant, including the impact of an authenticated user assigning themselves to other tenants using default tenant array field access. The source item from osv_dev provides information on the vulnerability. Official CVE Program record and NIST NVD detail page also provide relevant information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.