Payload fixed an access control flaw in MCP API keys that could lead to account takeover
Payload: Improper access control for MCP API keys
AI summary
Payload published a security advisory stating that under certain conditions, authenticated users can manage MCP API keys that do not belong to their accounts, allowing attackers to escalate privileges and achieve account takeover. This issue only affects applications using @payloadcms/plugin-mcp. The official fix is available in 3.88.0 and later versions, and an upgrade is recommended; before upgrading, you can disable the MCP plugin or restrict MCP API key management permissions to trusted users.