Cpe:2.3:a:payload:plugin_mcp:*:*:*:*:*:*:*:*

An improper access control vulnerability (CVE-2026-105806) in the @payloadcms/plugin-mcp package allows authenticated users to manage API keys across accounts, facilitating privilege escalation and account takeover.