CVE-2026-108114— Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Quick assessment
Affected
strapi strapi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Strapi 版本 5.47.0 至 5.57.0 存在一个不正确的授权漏洞，该漏洞允许管理 API 令牌在拥有者的角色字段受限后，仍保留所有字段的 Content Manager（内容管理器）访问权限。由于 reconcileTokenPermissionsToUserCeiling 函数会忽略省略或为空字段的令牌权限，令牌持有者仍可读取管理员已从角色中移除的内容字段。
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108114
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
Source: CVE Program / CVE List V5
Vulnerability Description
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-108114
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108114
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-108114 (1)
Security Blog Posts for CVE-2026-108114 (1)
-
🔗 Strapi admin token keeps all-field read access after the owner's role is field-restricted - HackMD Read full article technical-description exploit
Other References for CVE-2026-108114 (1)
-
🔗 Unicorn! · GitHub technical-description
IV. Related Vulnerabilities
Same product: strapi
-
CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS v -
CVE-2026-57997
Strapi users-permissions - JWT Algorithm Confusion via Missi -
CVE-2026-27886
Strapi may leak sensitive data via relational filtering due -
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API -
CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sess
Same vendor: strapi
-
CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS v -
CVE-2026-57997
Strapi users-permissions - JWT Algorithm Confusion via Missi -
CVE-2026-27886
Strapi may leak sensitive data via relational filtering due -
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API -
CVE-2026-22706
Strapi: Password Reset Does Not Revoke Existing Refresh Sess
Same weakness: CWE-863
-
CVE-2026-108604
Tabularis through 0.27.0 Read-Only Bypass via MCP run_query -
CVE-2026-108595
Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn W -
CVE-2026-108586
1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via -
CVE-2026-108550
SkillHub before 0.2.22 Account Takeover via Account Merge Fl -
CVE-2026-6723
Appointment Booking Calendar <= 1.6.11.11 - Incorrect Author
V. Comments for CVE-2026-108114
No comments yet