{"id":"CVE-2026-118170","aliases":[],"title":"The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller…","titleSource":"certcc","descriptionSource":"certcc","products":[{"vendor":"Strapi","name":"Strapi Open Source and Enterprise Headless CMS","platforms":[],"versions":[{"version":"5.51.0","status":"affected"}],"source":"certcc","url":"https://www.cve.org/CVERecord?id=CVE-2026-118170"}],"remediation":[],"description":"The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.","severity":"unknown","score":null,"published":"2026-10-27T18:02:55.025Z","modified":"2026-10-27T18:02:55.025Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/strapi/strapi/releases#release-v5.51.0"],"sources":[{"name":"CVE","id":"CVE-2026-118170","modified":"2026-10-27T18:02:55.025Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118170"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T04:55:31.812Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}