Medium WID-SEC-2026-3854 1 CVE

Strapi: Schwachstelle ermöglicht Offenlegung von Informationen

Published Oct 11, 2026 · Updated Oct 11, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Strapi ausnutzen, um Informationen offenzulegen.

Product

Strapi ist ein headless Content-Management-System (CMS), dass als Open-Source-Software entwickelt wird.

Vulnerabilities 1

Medium 4.3

CVE-2026-108114

Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token perm…

strapi strapi

Oct 10, 2026

Revision history

2026-10-11 #1
Initiale Fassung

References

GitHub Advisory Database vom 2026-10-11
https://github.com/advisories/GHSA-WMCH-QG2F-GRH3
VulnCheck Advisory vom 2026-10-11
https://www.vulncheck.com/advisories/strapi-5.47.0-through-5.57.0-improper-authorization-via-admin-api-token-field-permissions
Haind Blog Post mit PoC
https://hackmd.io/@haind/strapi-admin-token-field-ceiling