by Kastro
Paper/Archive/CVE-2026-118170

CVE-2026-118170

Strapi Strapi Open Source and Enterprise Headless CMS — CVE-2026-118170

EPSS 0.1%CVSS 9.1
critical.is priorityof 100
28
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 3.6.036 × 200.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.

Affected

ProductAffectedFixed inSource
Strapi Open Source and Enterprise Headless CMS5.51.0–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/strapi/strapi/releases#release-v5.51.0