{"id":"CVE-2026-118171","aliases":[],"title":"The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint.","titleSource":"certcc","descriptionSource":"certcc","products":[{"vendor":"Strapi","name":"Strapi Open Source and Enterprise Headless CMS","platforms":[],"versions":[{"version":"5.51.0","status":"affected"}],"source":"certcc","url":"https://www.cve.org/CVERecord?id=CVE-2026-118171"}],"remediation":[],"description":"The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.","severity":"unknown","score":null,"published":"2026-10-27T18:05:18.037Z","modified":"2026-10-27T18:05:18.037Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/strapi/strapi/releases#release-v5.51.0"],"sources":[{"name":"CVE","id":"CVE-2026-118171","modified":"2026-10-27T18:05:18.037Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118171"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:55:32.564Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}