CVE-2026-118171
CVE-2026-118171
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
| Vendor | strapi |
| Product | strapi open source and enterprise headless cms |
| Published | Oct 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for strapi strapi open source and enterprise headless cms
Be the first to know when new unknown vulnerabilities affecting strapi strapi open source and enterprise headless cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Strapi / Strapi Open Source and Enterprise Headless CMS
5.51.0