CVE-2026-118171: Npm/@strapi/content-manager vulnerability
Published Oct 27, 2026
·Updated
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
Affected Software
1 affected component
npm/@strapi/content-manager
Event History
Oct 27, 2026
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
DescriptionWeakness
Frequently Asked Questions
1
Which users can exploit this issue?
Low-privileged Strapi administrators are affected by this authorization gap.
2
What access does an attacker need to generate preview URLs?
The attacker needs low-privileged administrator access. They do not need to know document identifiers or have read permission for the content.