# CVE-2024-29181: Strapi Content Manager data disclosure via relations in admin panel

Source: https://junglewise.ai/threats/cve-2024-29181-strapi-content-manager-data-disclosure-via-relations-in-admin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-06-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-29181 · Severity: low · CVSS 3.1 · Published 2024-06-12

Strapi's Content Manager plugin is a tool used to manage and organize website content in a CMS system. A flaw in the plugin allows lower-privilege users (Authors) to see sensitive data created by administrators when they create new content with relationships to protected collections. This could expose passwords, emails, and other confidential information that should only be visible to admin users.

Technologies: [@strapi/plugin-content-manager (npm)](https://junglewise.ai/threats/technologies/strapi-plugin-content-manager). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-29181 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-29181 being exploited in the wild.

**How severe is CVE-2024-29181?** Low severity, with a CVSS score of 3.1, published 12 June 2024.

**Which products and versions are affected?** @strapi/plugin-content-manager (npm) SEMVER:introduced=0,fixed=4.19.1.

**Is there a fix for CVE-2024-29181?** Yes. @strapi/plugin-content-manager (npm): upgrade to 4.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-29181 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2024-29181?** Check whether you run @strapi/plugin-content-manager (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @strapi/plugin-content-manager (npm): upgrade to 4.19.1 or later

  ```sh
  npm install @strapi/plugin-content-manager@4.19.1
  ```


## Technical details

The vulnerability is an authorization/data disclosure flaw (CWE-639) in the @strapi/plugin-content-manager where role-based access controls are not properly enforced when displaying related collection items in dropdown menus. When an Author-role user creates a new item in a private collection that has associations to another private collection, the dropdown shows all items from the associated collection—including those created by administrators—instead of showing only items the Author user created. The attack requires an authenticated Author account, user interaction (creating an item and expanding the dropdown), and adjacent network access to the admin panel. An attacker can view protected data they should not have access to. The vulnerability affects all versions up to 4.19.0 and is fixed in 4.19.1.

## Affected products

- Strapi Content Manager <=4.19.0

## Identifiers

- CVE-2024-29181
- GHSA-6j89-frxc-q26m

## Timeline

- 2024-06-12: disclosed
- 2024-06-12: patched: Version 4.19.1 fixes the vulnerability
- 2024-06-12: advisory

## References

- [https://github.com/strapi/strapi/security/advisories/GHSA-6j89-frxc-q26m](https://github.com/strapi/strapi/security/advisories/GHSA-6j89-frxc-q26m)

## Related threats

- [Strapi field level permissions bypass in relationship title](https://junglewise.ai/threats/cve-2023-37263-strapi-field-level-permissions-bypass-in-relationship-title)
- [Strapi information disclosure in content-manager relations view](https://junglewise.ai/threats/cve-2023-36472-strapi-information-disclosure-in-content-manager-relations-view)
- [Strapi stored XSS in WYSIWYG editor preview](https://junglewise.ai/threats/cve-2020-27666-strapi-stored-xss-in-wysiwyg-editor-preview)