{"id":"EUVD-2026-93510","enisaUuid":"a1054dc8-b7cd-3f4b-8898-0ace6b6775a8","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:42:27 PM","dateUpdated":"Oct 6, 2026, 5:25:18 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-xhm9-gwgw-3q2q\nhttps://github.com/payloadcms/payload/commit/b8fc06a18afb6974dc07f95ac1e541c716e5926b\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105864\nGHSA-xhm9-gwgw-3q2q\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"4d4c69f0-29c5-3092-b1ca-90d5b249cc7f","product":{"name":"plugin-multi-tenant","vendor":{"name":"@payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"4e0d2617-b3ff-3f7b-93b2-d43e61ad9940","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"be3353bc-2472-3ffe-8ee0-ed51f3e8729c","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"dbede2f8-8b74-33fe-9b8b-9c539d876d10","product":{"name":"plugin-multi-tenant","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"enisaIdVendor":[{"id":"755b2b44-9b3a-32e7-8069-8db057979389","vendor":{"name":"payloadcms"}},{"id":"9ae5e6a9-e72a-38e1-b0d2-bda9fa7bbcff","vendor":{"name":"@payloadcms"}}],"enisaIdVulnerability":[{"id":"323277eb-cee5-3eb7-84d9-c92956981282","vulnerability":{"id":"CVE-2026-105864","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 4:42:27 PM","dateUpdated":"Oct 6, 2026, 5:25:18 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-xhm9-gwgw-3q2q\nhttps://github.com/payloadcms/payload/commit/b8fc06a18afb6974dc07f95ac1e541c716e5926b\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93510\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Nov 4, 2026, 7:15:38 AM","vulnerabilityProduct":[{"id":"6a57e49d-344c-3ba7-a00d-d20e90733443","product":{"name":"plugin-multi-tenant","vendor":{"name":"@payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"},{"id":"c0f181ea-4efd-32c1-b885-d1cd49316f6f","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"f09b8c49-8e3d-3581-ad9f-74a0ee5a843f","product":{"name":"plugin-multi-tenant","vendor":{"name":"@payloadcms"}},"product_version":"\u003c 3.90.0"},{"id":"f98997de-dfc3-3c78-aa34-1cd290958d24","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"94121ecc-f704-3b18-b653-f2409113d05e","vendor":{"name":"@payloadcms"}},{"id":"d952e99e-1c56-3bac-a9c5-4156faab919a","vendor":{"name":"payloadcms"}}]}},{"id":"3ce6f16c-109d-3b36-9b4d-b789819ac498","vulnerability":{"id":"GHSA-xhm9-gwgw-3q2q","description":"@payloadcms/plugin-multi-tenant has a cross-tenant create issue","datePublished":"Oct 7, 2026, 8:29:27 PM","dateUpdated":"Oct 7, 2026, 8:29:28 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-xhm9-gwgw-3q2q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105864\nhttps://github.com/payloadcms/payload/commit/b8fc06a18afb6974dc07f95ac1e541c716e5926b\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93510\n","aliases":"CVE-2026-105864\nGHSA-xhm9-gwgw-3q2q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}