Broken Access Control in Strapi Review Workflows Package by Strapi

CVE-2026-118170

What is CVE-2026-118170?

The Strapi review-workflows package is affected by a broken access control vulnerability. This issue allows unauthorized updates to documents, bypassing necessary permissions checks. As a result, users without the appropriate update rights can modify underlying documents, which poses a significant security risk. It is crucial for users to apply the latest security patches and review access permissions to mitigate potential exploits.

References