CVE-2026-105860: Payload has a tenant authorization bypass in Multi-Tenant Plugin

October 7, 2026

When using the default tenant array field access, an authenticated user could assign themselves to other tenants.

You are affected if:

You are using @payloadcms/plugin-multi-tenant

If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior.

References

github.com/advisories/GHSA-p96c-xwx8-3cqj
github.com/payloadcms/payload/commit/19b58692d20d3947f31124bf7a88ac14a5ebf02e
github.com/payloadcms/payload/releases/tag/v3.90.0
github.com/payloadcms/payload/security/advisories/GHSA-p96c-xwx8-3cqj
nvd.nist.gov/vuln/detail/CVE-2026-105860

Code Behaviors & Features

Detect and mitigate CVE-2026-105860 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →