Authorization Bypass

Payload CMS is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access controls on the default tenant array field in @payloadcms/plugin-multi-tenant, which allows an authenticated attacker to assign their own account to other tenants and gain unauthorized cross-tenant...