Vulnerability · Published Oct 27, 2026 · Assigned by certcc
CVE-2026-118171CVE-2026-118171
Medium 6.5
In plain English
A medium-severity missing authorization in Strapi Open Source and Enterprise Headless CMS from Strapi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 83.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Strapi | Strapi Open Source and Enterprise Headless CMS | 5.51.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N