{"id":"CVE-2026-118170","kind":"vulnerability","aliases":["CVE-2026-118170"],"related":[],"title":"Strapi review-workflows: updates skip the document's update-rights check","description":"The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.","summary":"The strapi/review-workflows package lets a caller update a document without first checking that the caller has update rights on it. An attacker with access to the endpoint could change content they are not allowed to edit.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","review-workflows","self-hosted","strapi"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T19:17:28+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","triaged_at":"2026-10-27T19:35:15+00:00","updated_at":"2026-10-27T19:35:15+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T19:35:15Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Strapi review-workflows: updates skip the document's update-rights check","impact":"medium","summary":"The strapi/review-workflows package lets a caller update a document without first checking that the caller has update rights on it. An attacker with access to the endpoint could change content they are not allowed to edit.","category":"package","nicknames":[],"who_cares":["strapi","cms","review-workflows","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized edits to documents the caller should not change","analyst_note":"Find the affected version range and fixed release in the GitHub advisory or Strapi security notes, and confirm whether an authenticated editor role is required.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Teams running the Strapi review-workflows plugin on a Strapi CMS where editors have restricted per-document permissions. Sites that do not install the plugin are not affected. The sources do not give affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000532,"input_tokens":3266,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118170':16A,19A '-2026':15A,18A 'access':52B,73C 'allow':62B,76C 'attack':50B 'broken':72C 'caller':34B,43B,85C 'chang':57B 'check':13A,40B 'cms':20B 'content':58B 'control':74C 'could':56B 'cve':14A,17A 'document':8A,37B,92C 'edit':64B 'endpoint':55B 'first':39B 'host':27B 'let':32B 'made':80C 'packag':21B,31B,67C 'possess':86C 'review':3A,23B 'review-workflow':2A,22B 'right':12A,46B,88C 'self':26B 'self-host':25B 'skip':6A 'strapi':1A,28B 'strapi/review-workflows':30B,66C 'under':91C 'updat':5A,11A,35B,45B,77C,87C 'update-right':10A 'verifi':82C 'vulner':69C,75C 'whether':83C 'without':38B,81C 'workflow':4A,24B","nicknames":[],"mitigations":[],"who_affected":"Teams running the Strapi review-workflows plugin on a Strapi CMS where editors have restricted per-document permissions. Sites that do not install the plugin are not affected. The sources do not give affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118170","severity":null,"published_at":"2026-10-27T19:17:28+00:00","modified_at":"2026-10-27T19:17:28+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}