Description
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
None
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected products
- strapi / strapi5.47.0 – 5.57.0
References
- MISChttps://hackmd.io/@haind/strapi-admin-token-field-ceiling
- MISChttps://github.com/strapi/strapi
- MISChttps://github.com/strapi/strapi/blob/v5.57.0/packages/core/admin/server/src/services/api-token.ts#L488-L498
- VENDOR_ADVISORYhttps://www.vulncheck.com/advisories/strapi-5.47.0-through-5.57.0-improper-authorization-via-admin-api-token-field-permissions
Updated 10m ago · 8 sources