CVE-2026-105806 | payloadcms Payload CMS up to 3.87.x plugin-mcp privileges management

October 6, 2026 Yanac

A vulnerability labeled as critical has been found in payloadcms Payload CMS up to 3.87.x. Affected by this vulnerability is an unknown functionality of the component plugin-mcp. Such manipulation leads to improper privilege management.

This vulnerability is documented as CVE-2026-105806. The attack can be executed remotely. There is not any exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More