Description
Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
strapi strapi
Default version status: unaffected
5.47.0 to ≤ 5.57.0affected
pkg:npm/%40strapi/adminReferences
- https://hackmd.io/@haind/strapi-admin-token-field-ceiling ↗
- https://github.com/strapi/strapi ↗
- https://github.com/strapi/strapi/blob/v5.57.0/packages/core/admin/server/src/services/api-token.ts#L488-L498 ↗
- https://www.vulncheck.com/advisories/strapi-5.47.0-through-5.57.0-improper-authorization-via-admin-api-token-field-permissions ↗