| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| payload | = 4.0.0< 3.90.0 | 3.90.0 |
| @payloadcms/plugin-multi-tenant | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0 | 4.0.0-canary.343.90.0 |
An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection.
Reads and direct edits to an existing target-tenant document were not bypassed.
You are affected if:
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
You can add access control with accessResultOverride on the multi-tenant collection config to ensure a user has access to the tenant before creating.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン