EUVD-2026-93469
GHSA-2q76-m6w6-qgc6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryAccess exposed MCP API Keys collection
-
ExploitCreate or reassign key to victim account
-
ExecutionAPI key acts as victim user
-
ImpactPrivilege escalation via account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires: (1) the target application uses @payloadcms/plugin-mcp at a version from 3.61.0 up to but excluding 3.88.0; (2) the attacker holds a valid authenticated account in the configured user collection (PR:L); and (3) the MCP API Key collection is actually reachable by that user - note the patch documentation states the key collection denies Admin Panel, REST, and GraphQL access by default, so an application must have exposed/configured that collection (e.g. via overrideApiKeyCollection) for the flaw to be exploitable. Limiting factors: applications not using the MCP plugin are entirely unaffected, and exploitation is impossible without an authenticated account, narrowing the attacker population to existing low-privilege users. |
| Impact | The vendor-assigned CVSS 4.0 score of 8.6 (HIGH) reflects a network-accessible flaw (AV:N/AC:L/AT:N) requiring only low privileges (PR:L) and no user interaction, with high confidentiality and integrity impact (VC:H/VI:H) via account takeover. However, several signals temper real-world urgency: there is no public exploit identified at time of analysis, no EPSS probability was provided, and this is not in CISA KEV - so there is no evidence of exploitation. Critically, the flaw is conditional: it only affects applications that actually deploy @payloadcms/plugin-mcp (versions 3.61.0 through 3.87.x), and the generated API Key collection denies Admin Panel, REST, and GraphQL access by default - meaning an application must have explicitly configured access to the API Key collection (e.g. via overrideApiKeyCollection) before an authenticated low-privilege user can reach and manage keys. This makes it a genuine but narrower privilege-escalation risk rather than a broadly wormable issue. Note the input tag 'Authentication Bypass' is inaccurate: the attacker is already authenticated (PR:L) and the root cause is CWE-862 Missing Authorization / improper access control, not authentication bypass. No CVSS vector conflicts with the description; the 4.0 vector is consistent with an authenticated privilege-escalation scenario. |
| Exploit ScenarioDerived | An authenticated low-privilege user of a Payload CMS instance that uses @payloadcms/plugin-mcp (with API Key collection access exposed) navigates to the MCP API Keys collection and creates or manages an MCP API key bound to another user's account. Because a key acts as its associated user, the attacker thereby impersonates a higher-privileged account and escalates privileges. No public exploit code is known, but the attack requires no special tooling beyond normal authenticated access to the key-management UI/API. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Improper access control in the npm package @payloadcms/plugin-mcp (versions 3.61.0 up to but excluding 3.88.0) lets any authenticated user of the configured user collection create, read, update, and delete MCP API keys belonging to other accounts; because an MCP key authenticates as the user it is bound to, an attacker can mint or rebind a key to a higher-privileged account and take it over. The flaw is network-reachable and requires only a low-privileged account (CVSS 4.0 score 8.6 and the independent assessment's CVSS 3.1 vector both carry PR:L with high confidentiality and integrity impact), and it is only exploitable when the application actually exposes the MCP API Key collection - installations that do not use @payloadcms/plugin-mcp are entirely unaffected. The vendor fixed the issue in 3.88.0; no public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Upgrade to @payloadcms/plugin-mcp 3.88.0 or later - the vendor-released patch - following the GitHub Security Advisory GHSA-2q76-m6w6-qgc6 and the v3.88.0 release notes, or apply the upstream fix commit 025581d8c5ed836039ad85397288a30f0d3c11c1 (Upstream fix available; released patched version not independently confirmed for downstream forks). If an immediate upgrade is impossible, the vendor's documented compensating controls are to disable the MCP plugin entirely (removes MCP tooling and API-key functionality, the most reliable mitigation but a functional loss) or to restrict MCP API-key management to trusted users (limits blast radius but does not close the cross-account access path, so it should be treated as temporary). In addition, review any overrideApiKeyCollection customization: the patch notes that the generated API Key collection denies Admin Panel, REST, and GraphQL access by default and that access must be manually defined, so audit custom access functions to ensure create/read/update/delete/unlock are gated to administrators and that the user field's create and update access is restricted - granting either to non-admins reintroduces the privilege-escalation path, since a key acts as its bound owner. Finally, treat existing MCP API keys as potentially compromised: enumerate the payload-mcp-api-keys collection for keys whose user binding is unexpected or was modified, revoke them, and rotate credentials for any affected accounts, accepting that this invalidates legitimate MCP integrations until they are re-provisioned by an administrator.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization) in Payload CMS's MCP plugin, which is built on Payload's collection-based access-control model. The plugin registers a payload-mcp-api-keys collection whose user field binds each API key to an owning account; requests authenticated with a key inherit that owner's identity. Two implementation gaps combined: (1) the Payload core API-key authentication branch in packages/payload/src/index.ts applied to any collection with auth.useAPIKey - including the internal MCP keys collection - instead of being restricted to real user collections, and (2) createApiKeysCollection originally omitted per-operation access rules, so the collection fell back to permissive behavior and the user field was writable, allowing arbitrary reassignment of a key to another user. The MCP HTTP endpoint (packages/plugin-mcp/src/endpoints/mcp.ts) also resolved access settings directly from an Authorization: Bearer header and looked up the key itself rather than deriving identity from the authenticated session, reinforcing the cross-account path. The fix (commit 025581d8c5ed836039ad85397288a30f0d3c11c1) excludes the payload-mcp-api-keys slug from Payload's generic API-key auth path, adds fail-safe isAuthenticated/restrictToOwnKeys access functions so users can only manage their own keys, and forces the user field to create: () => false, update: () => false with a defaultValue bound to req.user.id, making cross-user key issuance an explicit opt-in via overrideApiKeyCollection.
Know when Payload gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege user (PR:L) exploits missing authorization over the network (AV:N/AC:L) to take over other accounts, yielding high confidentiality and integrity impact; no availability impact and scope unchanged within the same CMS authority.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.
Technical POC Analysis
Evidence base: vendor advisory GHSA-2q76-m6w6-qgc6 (published 2026-09-22, reporter pavelkohout396) and a third-party automated report (gist alon710/20c58cb4d07d11bc54a823c67d892ac1, labelled "Automat…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The @payloadcms/plugin-mcp integration for Payload CMS (versions 3.61.0 up to but excluding 3.88.0) contains an improper access control flaw that lets any user with a valid low-privilege login view, create, modify, or delete the MCP API keys belonging to other users, including administrators. Because an MCP key authenticates as the account it is bound to, an attacker can mint or rebind a key against a privileged account and operate with that account's full authority, escalating a routine user credential into administrative control of the CMS. Only organizations that have deployed this plugin and exposed its MCP API Key collection are affected, but for those, CMS content, user administration, and any data reachable through MCP tooling are at risk; no public exploit code or confirmed active exploitation was identified at time of analysis.
Apply vendor patch: upgrade @payloadcms/plugin-mcp to 3.88.0 or later. If the upgrade cannot be completed immediately, restrict or disable the MCP API Key collection so only a dedicated administrative user collection can reach it, revoke and rotate all existing MCP API keys bound to privileged accounts, and monitor key-management events for cross-account creation or rebinding activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Str
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-ca
API key disclosure in Payload CMS lets an authenticated user with ordinary read access to other users' authentication do
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that docu
Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 contain an authorization bypass in relatio
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Exploit-DB