Is CVE-2026-108114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108114 being exploited in the wild.

How severe is CVE-2026-108114?

Medium severity, with a CVSS score of 4.3, published 10 October 2026.

Is there a fix for CVE-2026-108114?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108114 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108114?

Check whether you run Strapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108114: Strapi improper authorization in API token permission reconciliation

CVE-2026-108114 · Severity: medium · CVSS 4.3 · Published 2026-10-10

Strapi is an open-source headless content management system used to manage and deliver content via APIs. A vulnerability in versions 5.47.0 through 5.57.0 allows admin API tokens to bypass field-level access controls that administrators have put in place. An attacker with a compromised token could read sensitive content fields that should have been restricted, potentially exposing confidential data.

Technologies: Strapi. Vendors: Strapi.

Quick answers

Is CVE-2026-108114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108114 being exploited in the wild.
How severe is CVE-2026-108114?: Medium severity, with a CVSS score of 4.3, published 10 October 2026.
Which products and versions are affected?: Strapi 5.47.0 through 5.57.0.
Is there a fix for CVE-2026-108114?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108114 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108114?: Check whether you run Strapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the API token permission reconciliation logic (reconcileTokenPermissionsToUserCeiling), which fails to enforce field-level restrictions when permissions have omitted or null fields. When an administrator restricts a role's access to specific content fields, existing tokens for that role retain access to all fields, allowing attackers to bypass the intended restrictions. The issue affects the Content Manager API token authorization path without requiring additional authentication beyond possessing a valid token.

Affected products

Strapi Strapi 5.47.0 through 5.57.0

Timeline

2026-10-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.