Payload CMS CVE-2026-105860

Requires an authenticated low-privilege account in the plugin's tenant-managed admin users collection, and the application must run @payloadcms/plugin-multi-tenant before 3.90.0 (or a canary before 4.0.0-canary.34) using the DEFAULT tenant array field access. The attacker writes to the user's tenants array field to add their own account to tenants they are not a member of. Exploitation is explicitly PREVENTED when the deployment replaces the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions, or when the user passes userHasAccessToAllTenants; the fixed versions also enforce membership in a beforeValidate hook that rejects such writes.

Signals are moderate and internally consistent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privilege account (PR:L), and the impact is scoped to integrity of the tenant-isolation model (VI:H) with no confidentiality or availability impact declared. This matches CWE-862 (Missing Authorization): an already-authenticated user escalates cross-tenant assignment rather than breaking in from nothing. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit was referenced - exploitation status is 'no public exploit identified at time of analysis.' This is therefore a real but not emergency priority: dangerous specifically for multi-tenant SaaS deployments where tenant isolation is the security boundary, but gated behind authentication and limited to deployments running the plugin's default arrayFieldAccess behavior. Two caveats to verify: (1) the vendor rated VC:N, yet assigning one's own account into another tenant plausibly enables READING that tenant's data, so real-world confidentiality impact may be understated - verify against your data model; (2) deployments that override the defaults with secured tenants arrayFieldAccess.create/update functions are explicitly not affected, so actual exposure depends on configuration.

An attacker holds or registers a low-privilege account in a Payload application using the multi-tenant plugin with its default tenant array field access. Over the normal authenticated API, they submit a write that adds their own user to tenants they do not belong to, gaining cross-tenant access to data and administration they were never granted. No public exploit code was referenced, and the attack requires only a valid authenticated session with low complexity.