CVE-2026-108114: Strapi CMS Auth Bypass Vulnerability

CVE-2026-108114 Overview

CVE-2026-108114 is an improper authorization vulnerability [CWE-863] in Strapi versions 5.47.0 through 5.57.0. The flaw lets admin API tokens retain all-field Content Manager access after an administrator restricts the owning user's role to specific fields. The root cause lives in reconcileTokenPermissionsToUserCeiling, which ignores token permissions whose fields property is omitted or null. Token holders therefore continue reading content fields the administrator removed from the owning role, breaking least-privilege expectations for headless CMS deployments.

Critical Impact
Admin API tokens bypass field-level restrictions applied to the owning user's role, allowing unauthorized read access to Content Manager fields that administrators believed were revoked.

Affected Products

Strapi 5.47.0 through 5.57.0
Strapi Admin server package @strapi/admin (Content Manager API token path)
Self-hosted and Strapi Cloud deployments using admin API tokens with field-restricted roles

Discovery Timeline

2026-10-10 - CVE-2026-108114 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108114

Vulnerability Analysis

Strapi issues admin API tokens that inherit the permissions of a specific administrator user. When the administrator's role changes, Strapi runs reconcileTokenPermissionsToUserCeiling to narrow the token's effective permissions so they never exceed the user's current ceiling. The reconciliation routine evaluates each token permission against the user's role and intersects allowed actions and fields.

The function treats token permissions with an omitted or nullfields property as unrestricted. Instead of substituting the user's field ceiling, it leaves the token entry untouched. The token continues to grant read access across every field defined on the targeted content type.

An attacker holding a previously issued admin API token can read content fields that an administrator removed from the owning role. This is a confidentiality issue scoped to Content Manager read operations; integrity and availability are not affected. The vulnerability requires low privileges because the attacker must already possess a valid admin API token, and no user interaction is needed.

Root Cause

The defective ceiling logic lives in packages/core/admin/server/src/services/api-token.ts around lines 488-498 of release v5.57.0. The reconciliation code treats a missing fields array as "no restriction" rather than deriving the restriction from the user's role. See the GitHub Strapi API Token Code for the exact implementation and the HackMD Strapi Token Field Analysis for an annotated walkthrough.

Attack Vector

The attacker sends authenticated HTTP requests to Strapi's Content Manager API using an admin API token issued before the role was field-restricted. Requests targeting the affected content types return the full field set, including fields the administrator removed from the owner's role. No exploit code is required beyond standard Strapi API usage with the bearer token. Refer to the VulnCheck Strapi Improper Authorization Advisory for additional exploitation context.

Detection Methods for CVE-2026-108114

Indicators of Compromise

Admin API token requests to /content-manager/collection-types/* or /content-manager/single-types/* that return fields outside the owning user's current role.
Access log entries where the same token continues reading content types after the owning user's role was edited to remove fields.
Discrepancies between the field set defined for a role and the response payloads returned to tokens tied to that role.

Detection Strategies

Audit all admin API tokens, enumerate the owning user's role, and compare each token's effective field access against the role's permitted fields.
Review Strapi admin audit logs for role edits that reduced field access, then correlate against subsequent API traffic from tokens owned by the affected user.
Deploy an application-layer rule that flags Content Manager responses containing fields not present in the current role definition for the requesting token.

Monitoring Recommendations

Enable Strapi audit logs and forward them to a centralized SIEM for correlation with API gateway telemetry.
Alert on bulk read operations from admin API tokens, particularly after role modifications.
Track the inventory of long-lived admin API tokens and schedule periodic entitlement reviews.

How to Mitigate CVE-2026-108114

Immediate Actions Required

Inventory every admin API token in each Strapi environment and identify tokens whose owning user has field-restricted roles.
Revoke and reissue admin API tokens for any user whose role was narrowed after the token was created.
Restrict access to the Strapi admin API at the network layer until an upgrade is applied.

Patch Information

Strapi versions 5.47.0 through 5.57.0 are affected. Monitor the GitHub Strapi Repository for a release containing the corrected reconcileTokenPermissionsToUserCeiling logic and upgrade to a fixed version as soon as it is published. Review the VulnCheck Strapi Improper Authorization Advisory for the current fixed-version guidance.

Workarounds

Delete and regenerate admin API tokens whenever an owner's role is modified so new tokens inherit the current ceiling at creation time.
Prefer custom API tokens with explicitly scoped permissions over admin API tokens that inherit a user role.
Define field-level restrictions directly on API tokens where possible instead of relying on role reconciliation.
Place the Strapi admin API behind an authenticated reverse proxy that enforces an allowlist of required fields per route.

bash

# Configuration example
# Rotate affected admin API tokens via the Strapi admin UI or REST API
# Example: revoke a token by ID using an administrator session
curl -X DELETE \
  -H "Authorization: Bearer <ADMIN_JWT>" \
  https://strapi.example.com/admin/api-tokens/<TOKEN_ID>

# Then recreate the token after confirming the owning user's role fields
curl -X POST \
  -H "Authorization: Bearer <ADMIN_JWT>" \
  -H "Content-Type: application/json" \
  -d '{"name":"rotated-token","type":"custom","lifespan":2592000000}' \
  https://strapi.example.com/admin/api-tokens