Authorization Flaw in Strapi Content Manager by Strapi

CVE-2026-118171

What is CVE-2026-118171?

The strapi/content-manager package has a significant authorization flaw where low-privileged administrators can generate preview URLs via the content manager preview URL endpoint. This vulnerability arises from the lack of content-scope authorization, allowing these users to access and generate URLs without the necessary document identifiers or read permissions, potentially exposing sensitive content.

References