CVE-2026-118170: vulnerability facts

CVE-2026-118170

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.

EPSS 0.1%

Published: 2026-10-27T18:02:55.025Z
Updated: 2026-10-27T18:02:55.025Z

Affected products and versions

strapi open source and enterprise headless cms
Versions
- 5.51.0: Affected
No fix published

Original sources

https://github.com/strapi/strapi/releases#release-v5.51.0
https://nvd.nist.gov/vuln/detail/CVE-2026-118170

Check your server →

CVE-2026-118170

Affected products and versions

strapi open source and enterprise headless cms

Original sources