Unscored severity · published Oct 27, 2026
CVE-2026-118170
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights…
New
–
CVSS
0.1%
EPSS
No
On KEV
Description
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Strapi Open Source and Enterprise Headless CMS · Strapi
5.51.0 · source: vendor
Affected product
SO
Strapi Open Source and Enterprise Headless CMS
Strapi
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118170
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118170
github.com
https://github.com/strapi/strapi/releases#release-v5.51.0
More from Strapi Open Source and Enterprise Headless CMS
–
CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint
–
CVE-2026-118172
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect