# CVE-2020-27665: Strapi improper authorization in content-type-builder

Source: https://junglewise.ai/threats/cve-2020-27665-strapi-improper-authorization-in-content-type-builder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-10-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-27665 · Severity: low · CVSS 3.1 · Published 2020-10-29

Strapi is a popular open-source headless CMS used to manage website and application content. The vulnerability allows insufficiently privileged users to access administrative content-type configuration features without proper authorization checks. An attacker with limited admin panel access could modify content schemas and structures, potentially disrupting operations or exposing data.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-27665 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-27665 being exploited in the wild.

**How severe is CVE-2020-27665?** Low severity, with a CVSS score of 3.1, published 29 October 2020.

**Which products and versions are affected?** @strapi/plugin-content-type-builder (npm) SEMVER:introduced=0,fixed=3.2.5.

**Is there a fix for CVE-2020-27665?** Yes. @strapi/plugin-content-type-builder (npm): upgrade to 3.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-27665 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2020-27665?** Check whether you run @strapi/plugin-content-type-builder (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @strapi/plugin-content-type-builder (npm): upgrade to 3.2.5 or later

  ```sh
  npm install @strapi/plugin-content-type-builder@3.2.5
  ```


## Technical details

The vulnerability is an improper authorization issue (CWE-276/CWE-285) in the content-type-builder plugin component of Strapi. The CTB routes lacked the admin::hasPermissions middleware restriction, allowing users to make modifications to content types that should require elevated permissions. The attack requires network access to the Strapi admin panel and some form of authenticated access (even with limited permissions). An attacker can exploit this to read or modify content type definitions and structures. The vulnerability was fixed in Strapi 3.2.5 by adding proper permission middleware to the affected routes (GitHub PR #8439, merged October 22, 2020).

## Affected products

- Strapi strapi-plugin-content-type-builder before 3.2.5

## Identifiers

- CVE-2020-27665
- GHSA-4p55-xj37-fx7g

## Timeline

- 2020-10-23: disclosed
- 2020-10-22: patched: Fix merged in GitHub PR #8439

## References

- [https://github.com/strapi/strapi/pull/8439](https://github.com/strapi/strapi/pull/8439)
- [https://github.com/strapi/strapi/commit/3cdd73987950d5c7976701047b38203e902007bb](https://github.com/strapi/strapi/commit/3cdd73987950d5c7976701047b38203e902007bb)
- [https://github.com/strapi/strapi/releases/tag/v3.2.5](https://github.com/strapi/strapi/releases/tag/v3.2.5)
- [https://snyk.io/vuln/SNYK-JS-STRAPIPLUGINCONTENTTYPEBUILDER-1021616](https://snyk.io/vuln/SNYK-JS-STRAPIPLUGINCONTENTTYPEBUILDER-1021616)

## Related threats

- [Strapi SQL injection in Content-Type Builder API](https://junglewise.ai/threats/cve-2026-22599-strapi-sql-injection-in-content-type-builder-api)