Vulnerability · Published Oct 10, 2026 · Assigned by VulnCheck

CVE-2026-108114Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Medium 4.3

In plain English

A medium-severity incorrect authorization in strapi from strapi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.

Affected products (as reported)

Vendor	Product	Versions
strapi	strapi	5.47.0 – through 5.57.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@haind/strapi-admin-token-field-ceiling technical-description, exploit
https://github.com/strapi/strapi product
https://github.com/strapi/strapi/blob/v5.57.0/packages/core/admin/server/src/services/api-token.ts#L488-L498 technical-description
VulnCheck Advisory: Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions third-party-advisory