All vulnerabilities
CVE-2026-118171

CVE-2026-118171

Strapi Strapi Open Source and Enterprise Headless CMSFrameworks
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.

Text from CVE List

Affected versions 1

  • Strapi Open Source and Enterprise Headless CMSaffected: 5.51.0CVE List

References 1