Read the docs
TI-2021-12313 Aliases CVE-2021-32645GHSA-4r8q-gv9j-3xx6

Open Redirect in tenancy

Priority LOW 29CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.

Why it matters now

EPSS 0.0102 63rd percentileScored 2026-11-07
Fix Fixed multi-tenant (tenancy): 5.7.2hyn/multi-tenant (Packagist): 5.7.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
tenancymulti-tenant5.6.0 to before 5.7.25.7.2Patch availableCNA
—hyn/multi-tenant (Packagist)5.6.0 to before 5.7.25.7.2Patch availableGHSA-4r8q-gv9j-3xx6
  • multi-tenant Vendortenancy Affected 5.6.0 to before 5.7.2 Fixed in 5.7.2 Patch available CNA
  • hyn/multi-tenant (Packagist) Vendor— Affected 5.6.0 to before 5.7.2 Fixed in 5.7.2 Patch available GHSA-4r8q-gv9j-3xx6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tenancy:multi-tenant:*:*:*:*:*:*:*:*5.6.0 to before 5.7.2Vulnerabletenancy
  • cpe:2.3:a:tenancy:multi-tenant:*:*:*:*:*:*:*:* Versions 5.6.0 to before 5.7.2 Vulnerable ·tenancy

Remediation

  • Fix · CNA multi-tenant (tenancy) Fixed in 5.7.2
  • Fix · GHSA-4r8q-gv9j-3xx6 hyn/multi-tenant (Packagist) Fixed in 5.7.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32645
  2. 2026-10-03 Alias added: GHSA-4r8q-gv9j-3xx6

References

Patch 1

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences