Live › vulnerability › CVE-2026-118171
Go to dashboardThe @strapi/content-manager package's preview URL endpoint does not enforce content-scope authorization. A low-privileged admin can generate preview URLs for content without knowing document identifiers or holding read permission on it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:33 UTC. All times on this page are UTC.
Teams running a Strapi CMS with multiple admin roles where some admins are restricted to certain content types. The sources do not name the affected version range or say which configurations are exposed.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118171")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.