CVE-2026-105860

Published: Oct 6, 2026Modified: Oct 15, 2026

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Affected (35)

Products: Payloadcms: Payload

Payloadcms

1 product

Payload

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Payloadcms Payload	version < 3.90.0
Payloadcms Payload	Version 4.0.0 canary0
Payloadcms Payload	Version 4.0.0 canary10
Payloadcms Payload	Version 4.0.0 canary11
Payloadcms Payload	Version 4.0.0 canary12
Payloadcms Payload	Version 4.0.0 canary13
Payloadcms Payload	Version 4.0.0 canary14
Payloadcms Payload	Version 4.0.0 canary15
Payloadcms Payload	Version 4.0.0 canary16
Payloadcms Payload	Version 4.0.0 canary17
Payloadcms Payload	Version 4.0.0 canary18
Payloadcms Payload	Version 4.0.0 canary19
Payloadcms Payload	Version 4.0.0 canary1
Payloadcms Payload	Version 4.0.0 canary20
Payloadcms Payload	Version 4.0.0 canary21
Payloadcms Payload	Version 4.0.0 canary22
Payloadcms Payload	Version 4.0.0 canary23
Payloadcms Payload	Version 4.0.0 canary24
Payloadcms Payload	Version 4.0.0 canary25
Payloadcms Payload	Version 4.0.0 canary26
Payloadcms Payload	Version 4.0.0 canary27
Payloadcms Payload	Version 4.0.0 canary28
Payloadcms Payload	Version 4.0.0 canary29
Payloadcms Payload	Version 4.0.0 canary2
Payloadcms Payload	Version 4.0.0 canary30
Payloadcms Payload	Version 4.0.0 canary31
Payloadcms Payload	Version 4.0.0 canary32
Payloadcms Payload	Version 4.0.0 canary33
Payloadcms Payload	Version 4.0.0 canary3
Payloadcms Payload	Version 4.0.0 canary4
Payloadcms Payload	Version 4.0.0 canary5
Payloadcms Payload	Version 4.0.0 canary6
Payloadcms Payload	Version 4.0.0 canary7
Payloadcms Payload	Version 4.0.0 canary8
Payloadcms Payload	Version 4.0.0 canary9

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/payloadcms/payload/commit/19b58692d20d3947f31124bf7a88ac14a5ebf02e

Source: security-advisories@github.com

Patch

https://github.com/payloadcms/payload/releases/tag/v3.90.0

Source: security-advisories@github.com

PatchRelease Notes

https://github.com/payloadcms/payload/security/advisories/GHSA-p96c-xwx8-3cqj

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.