CVEvulnerability

CVE-2026-118171

Published 2026-10-27 Modified 2026-10-28 Official page ↗
Status
Deferred
Published
2026-10-27
Last modified
2026-10-28
Assigner
[email protected]

Description

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.

References