{"id":"CVE-2026-105806","aliases":["EUVD-2026-93469","GHSA-2q76-m6w6-qgc6"],"status":"published","title":"Payload: Improper access control for MCP API keys","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00252,"percentile":0.16803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-10-06T15:35:17Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"npm","package":"@payloadcms/plugin-mcp","fixed_in":["3.88.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@payloadcms/plugin-mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.61.0"},{"fixed":"3.88.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@payloadcms/plugin-mcp","ranges":[{"type":"SEMVER","events":[{"introduced":"3.61.0"},{"fixed":"3.88.0"}]}]}],"products":[{"vendor":"@payloadcms","product":"plugin-mcp"},{"vendor":"payloadcms","product":"payload"}],"references":[{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-2q76-m6w6-qgc6","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/payloadcms/payload/releases/tag/v3.88.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-2q76-m6w6-qgc6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105806.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105806","tags":["advisory"]},{"url":"https://github.com/payloadcms/payload","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-105806","title":"Payload: Improper access control for MCP API keys","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.","status":"published","published":"2026-10-06T15:35:17.028Z","modified":"2026-10-06T17:39:44.197Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-93469","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.","status":"published","published":"2026-10-06T15:35:17Z","modified":"2026-10-06T17:39:44Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:37.140631Z"}],"ghsa":[{"id":"GHSA-2q76-m6w6-qgc6","title":"Payload: Improper access control for MCP API keys","description":"### Impact\nUnder certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover.\n\nApplications that do not use `@payloadcms/plugin-mcp` are not affected.\n\n### Patches\nUsers should upgrade to `@payloadcms/plugin-mcp` version `3.88.0` or later.\n\n### Workarounds\nUpgrading is recommended. Until then, disable the MCP plugin or restrict MCP API-key management to trusted users.","status":"published","published":"2026-10-06T16:09:31Z","modified":"2026-10-06T16:09:33Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2026-105806","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.","status":"published","published":"2026-10-06T16:17:06.257Z","modified":"2026-10-06T20:03:40.69Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:54.486849Z"}],"osv":[{"id":"CVE-2026-105806","title":"Payload: Improper access control for MCP API keys","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.","status":"published","published":"2026-10-06T15:35:17.028Z","modified":"2026-10-28T02:30:33.788088127Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-2q76-m6w6-qgc6","title":"Payload: Improper access control for MCP API keys","description":"### Impact\nUnder certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover.\n\nApplications that do not use `@payloadcms/plugin-mcp` are not affected.\n\n### Patches\nUsers should upgrade to `@payloadcms/plugin-mcp` version `3.88.0` or later.\n\n### Workarounds\nUpgrading is recommended. Until then, disable the MCP plugin or restrict MCP API-key management to trusted users.","status":"published","published":"2026-10-06T16:09:31Z","modified":"2026-10-06T16:15:05.31493144Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}