CVE-2026-108114

Executive Summary

CVE-2026-108114 is an improper authorization vulnerability in Strapi versions 5.47.0 through 5.57.0 that allows admin API tokens to retain full-field Content Manager access even after an administrator applies field-level restrictions to the token owner's role. The flaw resides in the reconcileTokenPermissionsToUserCeiling reconciliation logic, which ignores token permissions where fields are omitted or null, causing the permission ceiling to be computed incorrectly and the removed field access to persist. Affected organizations are those running a vulnerable Strapi release with role-based field restrictions and active admin API tokens; the impact is unauthorized read access to content fields an administrator explicitly intended to restrict.

Technical Analysis

Strapi implements a role-based access control model in which administrative roles define which content types and, at finer granularity, which individual fields within those content types a role may read or modify. Admin API tokens are bound to a user (owner) and are expected to be constrained by that user's role permissions — a concept Strapi refers to as the token permission "ceiling."

The vulnerability is a logic flaw in the permission reconciliation routine reconcileTokenPermissionsToUserCeiling. When an administrator reduces a role's field-level permissions (for example, removing access to a specific set of fields in the Content Manager), the reconciliation function is responsible for recalculating each dependent token's effective permissions so that no token exceeds the owner's current ceiling. According to the NVD description, this function ignores token permissions whose fields attribute is omitted or null. Because a permission entry with no explicit field list is not processed during reconciliation, the token's previously granted field set is not trimmed. The token therefore retains the ability to read content fields that the administrator removed from the role.

Two conditions are required for exploitation:

1. A Strapi instance running a version in the range 5.47.0 through 5.57.0.
2. At least one admin API token whose associated permission records omit or null out the fields attribute, combined with a subsequent field-level restriction applied to the owner's role.

The attack surface is the administrative Content Manager API, which is network-reachable by default on the Strapi admin port. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N reflects network exploitability, low attack complexity, low privileges required (a valid admin API token), no user interaction, and a confidentiality-only impact, with integrity and availability unaffected. This is an authorization bypass (CWE-863, Incorrect Authorization) rather than an injection or memory-safety flaw — no code execution, no authentication bypass, and no privilege escalation beyond the stale field grant are implied by the available data.

Notably, the missing patch confidence (0/4) and the absence of affected-package mapping indicate the vulnerability is newly disclosed and no upstream fix has been published in tracked sources. No public proof-of-concept, Nuclei template, or exploit code exists at the time of writing.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (incorrect authorization via stale permission reconciliation) and the specific details in the NVD description.

1) Reconnaissance / target identification. An attacker or a low-trust insider with a valid admin API token identifies a Strapi 5.47.0–5.57.0 instance. This may be reachable via the admin port (default 1337) or through a reverse proxy exposing the Content Manager API. The attacker confirms the version through response headers or the admin UI.

2) Triggering the flaw class. The attacker (or an actor holding a token issued before a role change) relies on the fact that the token's permission entries omit or null the fields attribute. When an administrator reduces the owner's role to remove specific content fields, the reconcileTokenPermissionsToUserCeiling routine fails to clamp the token's access because those entries are skipped during reconciliation. The token's effective scope is never reduced.

3) Execution method. The attacker uses the still-valid admin API token to issue read requests against the Content Manager API for the restricted content type. Because authorization checks consult the stale token permission rather than the current role ceiling, the requests succeed and return the fields the administrator attempted to remove. The attack is a straightforward authenticated API read — no payload crafting or injection is involved.

4) Post-exploitation impact. The attacker obtains read access to content fields that were intended to be restricted (for example, sensitive metadata or private content attributes managed through the Content Manager). Data obtained can be exfiltrated within the normal API response or harvested at scale across the content type. No write, delete, or privilege-escalation capability is granted by this flaw; impact is limited to confidentiality of the affected fields.

Impact Assessment

The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Subscore interpretation:

• Confidentiality (Low): Only the specific field(s) removed from the role are exposed — not the entire content type or the underlying database. This bounds data exposure to the field-level scope of the misapplied restriction.
• Integrity (None): The vulnerability provides read access only; no modification of content or permissions is possible through the described mechanism.
• Availability (None): No denial-of-service or resource-exhaustion condition is described.
• Privileges Required (Low): Exploitation requires possession of a valid admin API token, which limits the threat to insiders, compromised token holders, or attackers who have already obtained token material.
• Scope (Unchanged): The impact remains within the vulnerable Strapi component's authorization domain.

Blast radius: Any Strapi deployment in the affected version range that uses admin API tokens with field-omitted permissions and has applied field-level role restrictions. In multi-tenant or headless-CMS deployments exposing content through the Content Manager API, the exposed fields may include sensitive editorial content, unpublished material, or personal data, raising regulatory exposure (GDPR/CCPA) depending on field contents. The practical risk is elevated in environments where administrators rely on field-level restriction as a data-minimization control while tokens remain long-lived — exactly the condition this flaw defeats.

Threat context: CISA KEV status is NO, EPSS is not yet scored by FIRST.org, and no exploit code or PoC is public. There is no known threat-actor campaign associated with this CVE at this time. The realistic threat model is an insider or a compromised token holder abusing a stale grant, not an opportunistic remote attacker.

Detection Guidance

Detection centers on anomalous Content Manager API reads from tokens whose role has recently been field-restricted, and on monitoring Strapi administrative permission-change events. Because exploitation is authenticated, detection must correlate role-change audit events with subsequent token-based field access.

Sigma Rule

title: Strapi Admin API Token Field Access After Role Field Restriction
id: 6a1f9c2e-4b7d-4e33-9c1a-8f2d5b0e7a41
status: experimental
description: Detects successful reads of restricted content fields via admin API tokens following a role field-level permission reduction on Strapi 5.47.0-5.57.0 (CVE-2026-108114).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108114
author: Threat Intelligence Team
date: 2026/01/01
logsource:
  product: strapi
  service: admin
detection:
  selection_role_change:
    event.action: "role.update"
    event.category: "iam"
  selection_field_restriction:
    permissions.fields: null
    permissions.action|contains: "plugin::content-manager"
  selection_token_access:
    event.action: "entry.read"
    user.token.type: "admin"
    http.response.status_code: 200
  condition: selection_token_access and (selection_role_change or selection_field_restriction)
falsepositives:
  - Legitimate administrators viewing content after intentional permission review
level: medium
tags:
  - attack.t1078
  - attack.persistence
  - cve.2026.108114

YARA Rule

rule CVE_2026_108114_Strapi_Token_Reconcile_Bypass
{
    meta:
        author = "Threat Intelligence Team"
        description = "Detects Strapi source referencing the vulnerable token permission reconciliation logic (CVE-2026-108114)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108114"
        date = "2026-01-01"
        hash = "unknown"
    strings:
        $fn = "reconcileTokenPermissionsToUserCeiling" ascii wide
        $fields = "fields" ascii wide
        $cm = "plugin::content-manager" ascii wide
        $nullcheck = "null" ascii wide
    condition:
        uint32(0) != 0x504B0304 and
        $fn and
        #fields > 2 and
        $cm
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108114 Strapi Admin Token Content Manager Field Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/content-manager/"; nocase; http.header; content:"Authorization"; nocase; pcre:"/Bearer\s+[A-Za-z0-9_\-\.]+/H"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,2026-108114; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108114; sid:2026108114; rev:1;)

Elastic Detection

sequence by user.name with maxspan=10m
  [iam where event.action == "role.update" and
     process.name == "strapi" and
     permissions.fields == null]
  [http where event.action == "content_manager.entry.read" and
     http.response.status_code == 200 and
     user.name == "admin-api-token"]

Splunk SPL Query

index=strapi sourcetype=strapi:admin
| search ("plugin::content-manager" AND (fields=null OR fields=""))
        OR event_action IN ("entry.read","entry.find")
| eval is_role_change=if(event_action="role.update",1,0)
| stats count values(event_action) as actions values(http_response_status_code) as status
        by token_id user_name src_ip
| where (is_role_change=1 OR match(actions,"entry\.(read|find)")) AND status=200
| sort - count

Wazuh OSSEC Rule

<group name="strapi,">
  <rule id="2026108" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.action">entry.read</field>
    <field name="user.token.type">admin</field>
    <field name="http.response.status_code">200</field>
    <description>CVE-2026-108114: Strapi admin API token read access to field-restricted content</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="2026109" level="10">
    <if_sid>2026108</if_sid>
    <field name="permissions.fields">null</field>
    <description>CVE-2026-108114: Possible token permission reconciliation bypass after role field restriction</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; the vulnerable range (5.47.0 - 5.57.0) has no vendor fix, workaround, or OSV package mapping available at the time of writing. The guidance below is compensating-control based.

1) Immediate mitigations

• Enforce least privilege on admin API tokens: whenever an administrator restricts a role's fields, revoke and re-issue every dependent admin API token rather than relying on automatic reconciliation, which is the exact control this flaw defeats.
• Audit all existing admin API tokens for permission entries where the fields attribute is omitted or null, and reset those entries to explicit field lists so reconciliation can clamp them correctly.
• Rotate any token previously issued to a role that has since been field-restricted, and treat data read by that token as potentially exposed.
• Restrict network access to the Strapi admin port (default 1337) and Content Manager API using firewall rules, VPN, or zero-trust proxy placement.
• Shorten token lifetimes and enforce regular rotation.

2) Patch / upgrade steps

• Monitor the Strapi security advisories and release notes for a fix covering 5.47.0–5.57.0. Do not assume an interim version is patched — verify against the official advisory before upgrade.
• When a fixed release is published, upgrade and then re-validate that all role field restrictions are correctly enforced on existing tokens.
• If upgrade is not immediately possible, isolate affected instances and apply the token-revocation mitigation above.

3) Long-term hardening

• Implement field-level restriction changes as an event-triggered workflow that automatically revokes dependent tokens.
• Add automated regression tests that assert token effective permissions never exceed the owner role ceiling after any role mutation.
• Centralize and alert on administrative permission-change events and correlate them with subsequent token access (see Detection Guidance).
• Adopt periodic entitlement review of admin API tokens and role definitions.

References

1. NVD — CVE-2026-108114: https://nvd.nist.gov/vuln/detail/CVE-2026-108114
2. MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
3. MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
4. Strapi Security Advisories / Release Notes (monitor for fix): https://strapi.io/security
5. CISA Known Exploited Vulnerabilities Catalog (verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: None. CISA KEV status is NO, no public PoC or exploit code exists, and no threat-actor campaign has been attributed to CVE-2026-108114 at this time.