CVE-2026-27407: AI Engine Editor+ Privilege Escalation via MCP OAuth (CVSS 7.2)

CVE-2026-27407 (CVSS 7.2) affects AI Engine ≤ 3.4.9. An Editor can exploit the MCP OAuth flow to get a token and escalate their role to administrator.