Plugin Multi Tenant
Monthly
Authenticated users of Payload CMS who are confined to a single tenant can create new records inside a different tenant whenever the @payloadcms/plugin-multi-tenant plugin (before 3.90.0, or canary before 4.0.0-canary.34) is installed and at least one tenant-enabled collection exists. The bypass is confined to record creation: reads and direct edits of pre-existing documents in the target tenant are still enforced, so the impact is integrity-only data injection rather than cross-tenant data disclosure or destruction, consistent with a CVSS score of 5.3. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated users of Payload CMS who are confined to a single tenant can create new records inside a different tenant whenever the @payloadcms/plugin-multi-tenant plugin (before 3.90.0, or canary before 4.0.0-canary.34) is installed and at least one tenant-enabled collection exists. The bypass is confined to record creation: reads and direct edits of pre-existing documents in the target tenant are still enforced, so the impact is integrity-only data injection rather than cross-tenant data disclosure or destruction, consistent with a CVSS score of 5.3. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.