CVE-2026-118170
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing…
- Risk score
- 60/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
Last activity 27 Oct 2026. Patch Forecast updates every hour.