CVE-2026-118170

Full vulnerability record from the local CVENow database.

Description

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-10-27 19:17:28.450000

Last modified

2026-10-28 15:24:56.033000

View original CVE JSON

{
  "id": "CVE-2026-118170",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-27T19:17:28.450",
  "lastModified": "2026-10-28T15:24:56.033",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Strapi",
          "product": "Strapi Open Source and Enterprise Headless CMS",
          "versions": [
            {
              "version": "5.51.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://github.com/strapi/strapi/releases#release-v5.51.0",
      "source": "[email protected]"
    }
  ]
}