CVE-2026-108114

Name of the Vulnerable Software and Affected Versions Strapi versions 5.47.0 through 5.57.0

Description An improper authorization issue exists where admin API tokens maintain full access to Content Manager fields even after the owner's role has been restricted. This occurs because the reconcileTokenPermissionsToUserCeiling() function ignores token permissions that contain null or omitted fields, allowing token holders to continue reading content fields that an administrator intended to remove from the role.

Recommendations Update Strapi versions 5.47.0 through 5.57.0 to a newer version that resolves this authorization issue.