CVE-2026-108114: Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-10 · updated 2026-10-16
Weakness: CWE-863

Description

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.

Affected products

strapi: from 5.47.0 through 5.57.0

References

https://github.com/strapi/strapi
https://github.com/strapi/strapi/blob/v5.57.0/packages/core/admin/server/src/services/api-token.ts#L488-L498
https://hackmd.io/@haind/strapi-admin-token-field-ceiling
https://www.vulncheck.com/advisories/strapi-5.47.0-through-5.57.0-improper-authorization-via-admin-api-token-field-permissions

Get alerted when CVE-2026-108114 or the next vulnerability affects your stack