open_source_and_enterprise_headless_cms vulnerabilities
CVEs whose affected-version data names the open_source_and_enterprise_headless_cms package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-118170NoneCVE-2026-118170
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
CVE-2026-118172NoneCVE-2026-118172
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC19…
CVE-2026-118171NoneCVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permis…