CVE-2026-118171
CVE-2026-118171
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
EPSS 0.1%
- Published
- Updated
Affected products and versions
strapi open source and enterprise headless cms
- Versions
- 5.51.0: Affected
No fix published