| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| payload | = 4.0.0< 3.90.0 | 3.90.0 |
| @payloadcms/plugin-multi-tenant | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0 | 4.0.0-canary.343.90.0 |
An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection.
Reads and direct edits to an existing target-tenant document were not bypassed.
You are affected if:
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
You can add access control with accessResultOverride on the multi-tenant collection config to ensure a user has access to the tenant before creating.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí