CVE-2026-105860: falha de alta gravidade em payloadcms payload
Payload: Tenant authorization bypass in Multi-Tenant Plugin
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
probabilidade de exploração
0.2%top 86% das CVEs
exploração observada
nãonenhuma fonte reporta
Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
payloadcms · payloadCVEs relacionadas — payloadcms payload
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25544CRITICALPayload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite AdaptersEPSS 1.0%CVE-2023-30843HIGHPayload's hidden fields can be leaked on readable collectionsEPSS 0.6%CVE-2026-105844CRITICALPayload: Prototype pollution in Payload Import Export pluginEPSS 0.5%CVE-2026-105858HIGHPayload: Remote Code Execution through first-registerEPSS 0.5%CVE-2026-105857CRITICALPayload: RCE in Payload Form BuilderEPSS 0.4%CVE-2026-34751CRITICALPayload has Unvalidated Input in Password Recovery EndpointsEPSS 0.4%