CVE-2026-105864: Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

Description

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 9% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PA

payload · payloadcms

< 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · source: vendor, NVD

PL

plugin-multi-tenant · @payloadcms

< 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · source: vendor