CVE-2026-118171

None

CVSS

—

EPSS

0.1%

Published

Oct 27, 2026

CISA due date

—

The record

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.

Affected packages

Ecosystem	Package	Introduced	Fixed