{"id":"CVE-2026-118170","title":"CVE-2026-118170","summary":"The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.","severity":"none","cwe":["CWE-862"],"vendor":"Strapi","product":"Strapi Open Source and Enterprise Headless CMS","affected":["open_source_and_enterprise_headless_cms 5.51.0"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T18:02:55.025Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118170","references":[{"url":"https://github.com/strapi/strapi/releases#release-v5.51.0"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T18:52:10.029Z","slug":"CVE-2026-118170","body":"## Overview\n\nThe strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.\n\n## Affected\n\n- `open_source_and_enterprise_headless_cms 5.51.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}