CVE-2026-108114
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manag
CVSS
4.3
Média
EPSS
0.2%
p10
KEV
—
Exploit Today
3
0-100
Publicado: 10 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-863
0.2%EPSS · 30 dias0.2%
2026-10-112026-11-05
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
- github.comhttps://github.com/strapi/strapi
- github.comhttps://github.com/strapi/strapi/blob/v5.57.0/packages/core/admin/server/src/services/api-token.ts#L488-L498
- hackmd.iohttps://hackmd.io/@haind/strapi-admin-token-field-ceiling
- www.vulncheck.comhttps://www.vulncheck.com/advisories/strapi-5.47.0-through-5.57.0-improper-authorization-via-admin-api-token-field-permissions
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1233343.8 BAI—
———In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project9hCVE-2026-1233333.8 BAI—
———In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints9hCVE-2026-1233286.4 MÉD—
———In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab9hCVE-2026-1233267.1 ALT—
———In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension9hCVE-2026-1233247.7 ALT—
———In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible9hCVE-2026-1232993.1 BAI—
———In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible9h