Strapi’s review‑workflows package contains a broken access control flaw that permits anyone who can reach the update endpoint to change the underlying document data without first verifying that the caller holds the proper update permissions. The vulnerability allows an attacker to alter protected records, potentially compromising data integrity and confidentiality of the CMS. No additional side effects such as denial‑of‑service are described in the advisory, and the problem is limited to the write operation exposed by the package.

The flaw affects both the Strapi Open Source and Enterprise Headless CMS that use the review‑workflows plugin. Version information is not explicitly listed in the advisory, so any deployment incorporating the vulnerable package is potentially impacted until a fix is applied.

The CVSS score is not provided, and the EPSS metric is unavailable, but the existence of a broken access control weakness suggests a potentially high exploitation likelihood for an attacker who can authenticate to the system with any account or for an unauthenticated attacker if the plugin endpoint is publicly exposed. The vulnerability is not currently listed in the CISA KEV catalog. Without a remedy, the attacker could modify any document the plugin allows updating, thereby creating or injecting illicit content.