WS-2026-0144

@payloadcms/plugin-mcp 3.64.0 through 3.87.1 and four 4.0.0-internal builds from May 2026: an operator-precedence bug in the default MCP API-key resolver made it ignore the key passed by a custom overrideAuth function and authenticate with the request's Authorization bearer header instead, so...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by CVE-2026-105806 via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: CVE-2026-105806 Source advisory: SNYK:JS-PAYLOADCMSPLUGINMCP-20826483...

CVE-2026-105806

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

GHSA-2Q76-M6W6-QGC6 Payload: Improper access control for MCP API keys

Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use @payloadcms/plugin-mcp are not affected. Patches Users should upgrade to...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by CVE-2026-105806 via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: CVE-2026-105806 Source advisory: GHSA-2Q76-M6W6-QGC6...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by CVE-2026-105806 via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: CVE-2026-105806 Source advisory: OSV:GHSA-2Q76-M6W6-QGC6...

Payload: Improper access control for MCP API keys

Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use @payloadcms/plugin-mcp are not affected. Patches Users should upgrade to...

CVE-2026-105806 Payload: Improper access control for MCP API keys

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

EUVD-2026-93469

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

CVE-2026-105806

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

CVE-2026-105806 Payload: Improper access control for MCP API keys

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

@frogbotai/plugin-mcp (>=0.14.0, <=0.21.0), @justanarthur/payload-www (>=1.0.1, <=1.4.2) +1 more potentially affected by CVE-2026-105806 via @payloadcms/plugin-mcp (>=3.85.0, <=3.87.1)

@payloadcms/plugin-mcp NPM version =3.85.0, =0.14.0, =1.0.1, =0.6.0, =0.7.0 Source cves: CVE-2026-105806 Source advisory: MEND:CVE-2026-105806...

CVE-2026-105806

The Payload headless content management system is vulnerable in the @payloadcms/plugin-mcp component (versions 3.61.0 through 3.88.0 ). Due to improper access control , an authenticated user can manage MCP API keys outside of their intended account, which may lead to privilege escalation through ...

CVE-2026-105806 Payload: Improper access control for MCP API keys

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

PT-2026-106768

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-mcp versions 3.61.0 through 3.87.0 Description An authenticated user can manage MCP API keys outside the intended account, which allows for privilege escalation through account takeover. Recommendations Update...

WS-2026-0154

@payloadcms/plugin-mcp 0.0.1-alpha.0, 3.61.0 through 3.87.1 and 4.0.0-canary.0 through 4.0.0-canary.30: the MCP login tool let the caller set showHiddenFields and overrideAccess on 3.x, so login responses could return hidden fields such as credential data GHSA-jjm7-864w-gg8q...

CVE-2026-105806: Missing Authorization

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

WS-2026-0153

@payloadcms/plugin-mcp 0.0.1-alpha.0, 3.61.0 through 3.89.0 and 4.0.0-canary.0 through 4.0.0-canary.30: the experimental MCP forgotPassword tool accepted disableEmail and returned the raw forgotPassword result, exposing another user's password-reset token, and resetPassword/unlock ran with...