Skip to content

CVE record · 1 source

CVE-2026-118171

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint.

Vendor: Strapi
Product: Strapi Open Source and Enterprise Headless CMS
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

7

CVE NVD 4d ago

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint.

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding…

CVE-2026-118171 Strapi