Skip to content

Product

payloadcms plugin-multi-tenant vulnerabilities

2 published CVES affecting payloadcms plugin-multi-tenant, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest payloadcms plugin-multi-tenant CVEs

Newest publication first

  1. CVE-2026-105864 Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

    Published
    MediumCVSS 5.3 EPSS 0.20%

    Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-e...

  2. CVE-2026-105860 Payload: Tenant authorization bypass in Multi-Tenant Plugin

    Published
    HighCVSS 7.1 EPSS 0.19%

    Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.