{"id":"CVE-2026-105806","revision":"2f2334433f62450793f4c387bd141b12","records":[{"revision":"2f2334433f62450793f4c387bd141b12","observedAt":"2026-10-25T04:17:29.458+00:00","statement":{"source":"nvd","id":"CVE-2026-105806","aliases":[],"title":"Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation thr…","description":"Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.","state":0,"publishedAt":"2026-10-06T16:17:06.257+00:00","modifiedAt":"2026-10-06T20:03:40.69+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.6,"severity":"HIGH"}],"references":["https://github.com/payloadcms/payload/commit/025581d8c5ed836039ad85397288a30f0d3c11c1","https://github.com/payloadcms/payload/releases/tag/v3.88.0","https://github.com/payloadcms/payload/security/advisories/GHSA-2q76-m6w6-qgc6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105806","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Undergoing Analysis","weaknesses":["CWE-862"],"productCriteria":[],"sourceDates":{"published":"2026-10-06T16:17:06.257","lastModified":"2026-10-06T20:03:40.690"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-105806","identifiers":["CVE-2026-105806"]},"retained":false,"historicalAffected":[]}],"coverage":[]}