Homepage

@payloadcms/plugin-multi-tenant@3.88.0

Multi Tenant plugin for Payload

  • latest version

    3.91.0

  • latest non vulnerable version

    4.0.0-internal.fec2230

  • first published

    1 years ago

  • latest version published

    4 days ago

  • licenses detected

  • View plugin-multi-tenant package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @payloadcms/plugin-multi-tenant package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Missing Authorization

    @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload

    Affected versions of this package are vulnerable to Missing Authorization via the tenant field write path in tenantField/index.ts, where tenant membership is not enforced on create or update operations. An authenticated user can assign themselves to arbitrary tenants by submitting write requests that reference tenant IDs they do not belong to, bypassing the intended multi-tenant isolation boundary.

    Note: This is only exploitable when using the default tenant array field access configuration.

    How to fix Missing Authorization?

    Upgrade @payloadcms/plugin-multi-tenant to version 3.90.0, 4.0.0-canary.34 or higher.

    <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
    • M
    Incorrect Authorization

    @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload

    Affected versions of this package are vulnerable to Incorrect Authorization via the tenantField default value logic in packages/plugin-multi-tenant/src/fields/tenantField/index.ts, where the return value of req.payload.count() is used directly as a boolean rather than checking the totalDocs property. Because any non-null object is truthy in JavaScript, the tenant validity check always evaluates to true, allowing an authenticated user to set an arbitrary tenant cookie value and have it accepted as a valid tenant, bypassing tenant isolation controls.

    How to fix Incorrect Authorization?

    Upgrade @payloadcms/plugin-multi-tenant to version 3.90.0, 4.0.0-canary.34 or higher.

    <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34
    Go back to all versions of this package