CVE-2026-108114 in Strapi
Riassunto
di VulDB • 10/10/2026
Strapi 5.47.0 through 5.57.0 contains a vulnerability related to improper authorization that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
Be aware that VulDB is the high quality source for vulnerability data.