Vulnerability	Vulnerable Version
M Incorrect Authorization @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Incorrect Authorization via `reconcileTokenPermissionsToUserCeiling`, which ignores token permissions with omitted or null fields. When an administrator restricts a role's field-level access in the Content Manager, admin API tokens belonging to that role retain their original all-field read access because the reconciliation function does not apply the updated field restrictions to existing token permissions. An authenticated token holder can therefore continue reading content fields that the administrator explicitly removed from the role. How to fix Incorrect Authorization? There is no fixed version for `@strapi/admin`.	>=5.47.0

Incorrect Authorization

@strapi/admin is a Strapi Admin

Affected versions of this package are vulnerable to Incorrect Authorization via reconcileTokenPermissionsToUserCeiling, which ignores token permissions with omitted or null fields. When an administrator restricts a role's field-level access in the Content Manager, admin API tokens belonging to that role retain their original all-field read access because the reconciliation function does not apply the updated field restrictions to existing token permissions. An authenticated token holder can therefore continue reading content fields that the administrator explicitly removed from the role.

How to fix Incorrect Authorization?

There is no fixed version for @strapi/admin.

>=5.47.0

Go back to all versions of this package