Live › vulnerability › CVE-2026-118170
Go to dashboardThe strapi/review-workflows package lets a caller update a document without first checking that the caller has update rights on it. An attacker with access to the endpoint could change content they are not allowed to edit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:33 UTC. All times on this page are UTC.
Teams running the Strapi review-workflows plugin on a Strapi CMS where editors have restricted per-document permissions. Sites that do not install the plugin are not affected. The sources do not give affected version ranges.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
This page as .md · .json · in your agent: get_signal("CVE-2026-118170")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.