CVE-2026-105860

— UNSCOREDpublic exploit available

Published 2026-10-06 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and tenants arrayFieldAccess.update functions are not affected by this behavior. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/payloadcms/payload/commit/19b58692d20d3947f31124bf7a88ac14a5ebf02e
https://github.com/payloadcms/payload/releases/tag/v3.90.0
https://github.com/payloadcms/payload/security/advisories/GHSA-p96c-xwx8-3cqj

All references

https://github.com/payloadcms/payload/commit/19b58692d20d3947f31124bf7a88ac14a5ebf02e
https://github.com/payloadcms/payload/releases/tag/v3.90.0
https://github.com/payloadcms/payload/security/advisories/GHSA-p96c-xwx8-3cqj

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
HIGHCVE-2025-71433PoC
MEDIUMCVE-2026-0198
HIGHCVE-2026-100217
CRITICALCVE-2026-100240
HIGHCVE-2026-100266

Related by shared AI tags and CWE weakness class. Browse the full archive.