GHSA-P96C-XWX8-3CQJ Payload has a tenant authorization bypass in Multi-Tenant Plugin

Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. You are affected if: - You are using @payloadcms/plugin-multi-tenant If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership...

@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105860 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)

@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105860 Source advisory: OSV:GHSA-P96C-XWX8-3CQJ...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105861 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105861 Source advisory: GHSA-PJ5H-5Q6C-3PFX...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105861 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105861 Source advisory: OSV:GHSA-PJ5H-5Q6C-3PFX...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105861 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105861 Source advisory: SNYK:JS-PAYLOAD-20570534...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105862 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105862 Source advisory: GHSA-2PWP-2369-8FG3...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105862 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105862 Source advisory: SNYK:JS-PAYLOAD-20570517...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105862 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105862 Source advisory: OSV:GHSA-2PWP-2369-8FG3...

@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105864 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)

@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105864 Source advisory: OSV:GHSA-XHM9-GWGW-3Q2Q...

@payloadcms/plugin-multi-tenant has a cross-tenant create issue

Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...

GHSA-XHM9-GWGW-3Q2Q @payloadcms/plugin-multi-tenant has a cross-tenant create issue

Impact An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection. Reads and direct edits to an existing target-tenant document were not bypassed. You are affected if: - You are using...

Incorrect Authorization

Overview @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload Affected versions of this package are vulnerable to Incorrect Authorization via the tenantField default value logic in packages/plugin-multi-tenant/src/fields/tenantField/index.ts, where the return value of...

@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105864 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)

@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105864 Source advisory: GHSA-XHM9-GWGW-3Q2Q...

EUVD-2026-93510

@payloadcms/plugin-multi-tenant has a cross-tenant create issue...

@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105864 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)

@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105864 Source advisory: SNYK:JS-PAYLOADCMSPLUGINMULTITENANT-20883332...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105865 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105865 Source advisory: GHSA-P223-2WR2-J562...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105865 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105865 Source advisory: OSV:GHSA-P223-2WR2-J562...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105865 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105865 Source advisory: SNYK:JS-PAYLOAD-20570545...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105866 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105866 Source advisory: SNYK:JS-PAYLOADCMSNEXT-20570506...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105866 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105866 Source advisory: SNYK:JS-PAYLOAD-20570505...