CVE-2026-105806

UNKNOWN

Description

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.

Timeline

Published:October 6th, 2026 4:17 PM

Last modified:October 6th, 2026 8:03 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1
https://github.com/payloadcms/payload/releases/tag/v3.88.0
https://github.com/payloadcms/payload/security/advisories/GHSA-2q76-m6w6-qgc6

Source: NIST NVD · Data may lag official sources by up to one minute