Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager… (CVE-2026-108114)
Description
Strapi versions 5.47.0 through 5.57.0 have an improper authorization vulnerability (CVE-2026-108114) where admin API tokens retain full Content Manager access even after the owner's role is restricted. This occurs because the reconciliation process ignores token permissions with omitted or null fields, allowing token holders to access content fields removed from their role.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108114 affects Strapi versions 5.47.0 through 5.57.0. The vulnerability is due to improper authorization in the handling of admin API tokens. Specifically, the function reconcileTokenPermissionsToUserCeiling fails to properly restrict token permissions when fields are omitted or null, causing tokens to retain broader Content Manager access than intended after the owner's role is restricted. This allows token holders to read content fields that should have been removed from their access scope.
Potential Impact
The vulnerability allows users holding admin API tokens to retain read access to all content fields managed by the Content Manager, even if their role has been restricted to limit such access. This could lead to unauthorized disclosure of content data. The CVSS score is 4.3 (medium severity), indicating limited impact primarily on confidentiality with no impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict admin API token usage carefully and monitor for any unauthorized access. Avoid relying solely on role restrictions to enforce field-level access controls for tokens.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wmch-qg2f-grh3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108114"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6acaad7f2cdf04f65651429e
Added to database: 10/10/2026, 21:26:23 UTC
Last enriched: 10/10/2026, 21:28:53 UTC
Last updated: 10/10/2026, 23:08:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.