The strapi/content-manager package has a vulnerability in its content manager preview URL endpoint where content-scope authorization is missing. This flaw allows low-privileged administrators to generate preview URLs without needing to know document identifiers or having read permissions.