CVE-2026-118170 is a broken access control vulnerability in the strapi/review-workflows package of Strapi Open Source and Enterprise Headless CMS version 5.51.0. It allows unauthorized updates to documents without verifying the caller's update rights.