The vulnerability stems from a missing content-scope authorization check in the content manager preview URL endpoint of the strapi/content-manager package. Low-privileged administrators can generate preview URLs without possessing read permissions or knowing the underlying document identifiers. This allows them to view content that should otherwise be restricted, potentially exposing confidential or sensitive information. The flaw does not grant arbitrary code execution but enables unauthorized access to proprietary or private data through preview links.

All versions of Strapi Open Source and Enterprise Headless CMS that include the strapi/content-manager package prior to the release of v5.51.0 are affected. No specific version ranges are listed in the advisory, so any deployment using a vulnerable version should be considered impacted until it is patched.

The exploit probability (EPSS) is not available, and the vulnerability is not listed in CISA's KEV catalog. No CVSS score is provided, so the exact severity cannot be quantified. The attack vector is inferred to be internal; a user with a low‑privileged admin role can exploit the flaw without needing external network access. The impact is limited to unauthorized data disclosure rather than system compromise, but it remains a significant privilege escalation risk if sensitive content is exposed.