CVE-2026-108114

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108114

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108114.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108114

Published

2026-10-10T14:15:50Z

Modified

2026-10-28T02:30:38Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Details

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108114.json"
}

References

Affected packages

Git / github.com/strapi/strapi

Affected ranges

Type

GIT

Repo

https://github.com/strapi/strapi

Events

Introduced

42509493bfdd2e91c3899fb4164ad63ef772706e

Last Affected

ca3974dac3171b4ffc94d70c27f1df7e4dad5a7d

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "5.47.0"
                },
                {
                    "last_affected": "5.57.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "5.47.0"
                },
                {
                    "last_affected": "5.57.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108114.json"