–
Not scored
CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint.
Strapi Open Source and Enterprise Headless CMSAffectedStrapi Open Source and Enterprise Headless CMS
FixNo fix listed yet.
PublishedOct 27, 18:05 · certcc
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
From certcc
Affected and fixed versions
ProductAffectedFixed inStrapi Open Source and Enterprise Headless CMS5.51.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known