Description
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Strapi | Strapi Open Source and Enterprise Headless CMS | 5.51.0 | — |