Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access…
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Strapi
- Product
- Strapi
- CVSS
- 4.3
- Exposure class
- Web platform
Why it ranks 8 (Routine)
- CVSS 4.3 medium
- Product class: web platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.