External risk intelligence

Strapi Review Workflows Broken Access Control Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-118170

Strapi is a headless content management system commonly deployed as an internet-facing web application or API service to serve content and manage data via public endpoints. The vulnerability involves access control within a package used to manage workflows, which is frequently exposed in typical deployments of web-based CMS platforms.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the strapi/review-workflows package, a component within the widely used Strapi content management system. The issue involves broken access control, which could allow unauthorized modifications to documents. Given that Strapi is often exposed publicly, this vulnerability presents a potential risk to data integrity and unauthorized content changes.

Unauthorized users may alter content.
Protects data integrity and unauthorized content changes.
Confirm relevance and address if exposed.

Attack Path

How an attacker could exploit the issue

An attacker can target the strapi/review-workflows package without needing any special privileges or prior access. By sending specially crafted requests, they can bypass the intended access controls and directly modify workflow-related documents, potentially leading to unauthorized changes or data manipulation.

No authentication or prior access required.
Bypass access controls on workflow updates.
Unauthorized document modifications.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the review-workflows package could allow an unauthenticated attacker to modify documents without proper authorization, potentially impacting the integrity of data managed by systems using this package. When supported by the advisory's context, this could affect system data and sensitive information.

Unauthorized document modifications.
Improper access control checks.
Data integrity compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This broken access control vulnerability in the strapi/review-workflows package likely impacts application owners and platform teams responsible for Strapi deployments. The first practical step is to identify all Strapi instances, confirm their external reachability and business criticality, and then assign ownership for remediation planning.

Application owners should prioritize review.
Verify all Strapi instance exposures.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the strapi/review-workflows package?

This package is a specialized module for Strapi, a headless content management system (CMS). Developers use Strapi to build dynamic websites and applications by separating the content storage from the display layer. The review-workflows component specifically handles the governance and approval processes for document states, ensuring that content moves through defined lifecycles before being published or updated.

What does broken access control mean for CVE-2026-118170?

This vulnerability is classified as CWE-862, which refers to missing authorization checks. In the context of this CVE, it means the software fails to verify if a user has the necessary permissions before performing an action. Consequently, the system processes requests to update documents without ensuring the caller is actually authorized to make those changes, effectively treating all requests as if they come from a trusted source.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by sending specifically crafted network requests to the affected application. Because the software lacks proper verification, no prior authentication, user accounts, or special system privileges are required to exploit it. Note that this bug is specific to workflow document updates; it does not necessarily imply that all aspects of the CMS are universally vulnerable to every type of unauthorized command.

Do I need to worry if my Strapi instance is internal?

Halo Surface Signal indicates that Strapi is frequently deployed as an internet-facing service, which significantly increases the risk for this specific vulnerability. While internal-only instances have a reduced attack surface because they are not reachable from the public web, any system where the review-workflows package is active remains theoretically susceptible if an attacker gains any internal network access.

How should I respond to this threat?

Start by auditing your environment to locate all running instances of Strapi that utilize the review-workflows package. Once you have an inventory, determine which instances are accessible via the internet and categorize them by their data sensitivity. Consult the official Strapi release documentation for version v5.51.0 or later to identify the available updates and coordinate with your team to apply the necessary patches as soon as possible.

References

github.com/strapi/strapi/releases

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.