← Back to search

CVE-2026-118171

— UNSCOREDpublic exploit available

Published 2026-10-27 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.