Skip to content
Threat Feed
Subscribe

Product

Plugin-Mcp (>= 3.61.0, < 3.88.0)

1 brief RSS
high advisory

Improper Access Control in Payload CMS MCP Plugin

An improper access control vulnerability (CVE-2026-105806) in the @payloadcms/plugin-mcp package allows authenticated users to manage API keys across accounts, facilitating privilege escalation and account takeover.

plugin-mcp privilege-escalation cms web-application
1c