CVE-2026-118171

MediumCVSS 6.5/10Last modified Nov 4, 2026

Description

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Strapi	Strapi Open Source and Enterprise Headless CMS	5.51.0

References

https://github.com/strapi/strapi/releases#release-v5.51.0

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1181726.1The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispat CVE-2026-1181736.1MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. CVE-2026-1181746.5When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer import CVE-2026-1181757.5When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the CVE-2026-1181768.1Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-lengt CVE-2026-1181779.1When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted cale CVE-2026-1181785.7A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.CVE-2026-1181798.8Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the lin CVE-2026-118185.4The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all CVE-2026-1181807.5When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. CVE-2026-1181845.3The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in CVE-2026-1181857.5The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for