CVE-2026-118170 in Strapi
Summary
by MITRE • 10/27/2026
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability in the strapi/review-workflows module represents a critical failure in server-side access control mechanisms, specifically categorized under CWE-285 Improper Authorization. This flaw allows an authenticated user to perform state-changing operations on workflow-related documents without possessing the necessary permissions for the underlying content entities they are attempting to modify or review. In typical Content Management System architectures like Strapi, a clear separation exists between administrative privileges required to manage system configurations and standard editor rights needed to update specific pieces of content. The vulnerability disrupts this boundary by bypassing the verification step that checks whether the caller holds valid update rights for the target document before processing the workflow action.
From a technical perspective, the root cause lies in the logic governing how review workflows interact with core entity updates. When a user initiates an action within the review workflow interface, such as moving content to a different stage or approving it, the system fails to re-validate the authorization context against the specific resource being affected. Instead of ensuring that the current session has explicit write permissions for the underlying document ID associated with the workflow entry, the application relies on insufficient checks or assumes privilege escalation based solely on access to the workflow module itself. This oversight enables an attacker who may only have read-only or limited editorial privileges to effectively alter content status and metadata by exploiting the loose coupling between the workflow engine and the core authorization middleware.
The operational impact of this broken access control is significant, as it undermines the integrity of the content management process. Attackers can manipulate the lifecycle of digital assets without proper oversight, potentially pushing unapproved or maliciously altered content into production environments if automated publishing workflows are in place. This capability also facilitates data tampering and unauthorized modifications to sensitive information that should be protected by stricter role-based access controls. Furthermore, it compromises audit trails since actions performed through this vulnerability may not correctly attribute the changes to a user with appropriate authority, making forensic analysis and compliance reporting difficult or inaccurate.
To mitigate this risk, immediate remediation efforts must focus on enforcing strict authorization checks at every step of the workflow interaction process. Developers should implement robust middleware that verifies the current user's permissions against the specific resource being accessed before allowing any state transition within the review workflows module. This includes validating update rights for both the workflow entry and the associated underlying document entity. Additionally, adopting a principle of least privilege ensures that users are granted only the minimum access necessary to perform their duties, reducing the attack surface. Regular security audits and penetration testing focused on horizontal and vertical privilege escalation scenarios will help identify similar gaps in other modules where resource-level permissions might be overlooked during API calls or internal function invocations aligned with MITRE ATT&CK techniques related to unauthorized access and lateral movement within application layers.