CVE-2026-108114 — Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is f…
Published: 2026-10-10 · CVSS: 5.3 · CVSS 4.0
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7