Strapi versions 5.47.0 through 5.57.0 contain an authorization flaw that allows an admin API token to retain access to all content fields even after the owning role has had those fields revoked. The bug stems from the token permission reconciliation logic that ignores omitted or null field entries, enabling the token holder to read fields an administrator has explicitly removed from their role. This exposes sensitive data, potentially leading to confidentiality violations without the need for elevated privileges.

The affected product is Strapi, specifically the open‑source CMS released under the Strapi brand. All installations running any release from 5.47.0 up to and including 5.57.0 are vulnerable. Versions prior to 5.47.0 and post‑5.57.0 are not affected according to the CNA data.

The CVSS score of 5.3 indicates a moderate impact, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is not currently available, so the likelihood of exploitation remains unknown. The likely attack vector is that a user who already possesses or can acquire an admin API token (for example, through credential compromise or misuse of existing tokens) can exploit the flaw to read data fields that should be blocked by role restrictions. Because the flaw operates entirely within the authenticated token scope, no additional privileges are required beyond the pre‑existing token rights.