Skip to content
OpenAdvisories

Product · strapi

Strapi Open Source and Enterprise Headless CMS

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-118171

    CVE-2026-118171

    The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.

    strapi Strapi Open Source and Enterprise Headless CMS
  • Medium 6.1
    CVE-2026-118172

    CVE-2026-118172

    The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary…

    strapi Strapi Open Source and Enterprise Headless CMS