CVE-2026-108114: Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using Strapi versions 5.47.0 through 5.57.0 are exposed if they use admin API tokens for Content Manager access and later restrict the token owner's role to specific fields.
What does an attacker need to exploit it?
An attacker needs possession of an affected admin API token. The token can continue to read content fields after those fields have been removed from the owning user's role permissions.
Are default configurations affected?
The issue depends on a permission change: an admin API token must have retained all-field Content Manager access while its owner's role is subsequently field-restricted. The provided information does not establish whether this occurs in a default deployment.
How can administrators determine whether tokens may be overprivileged?
Review admin API tokens owned by users whose roles were changed to restrict Content Manager fields. Tokens with permissions whose fields are omitted or null may retain access beyond the owner's current field permissions.