Insecure Authorization

strapi-plugin-content-type-builder suffers from insecure authorization. The admin::hasPermissions restriction for the content-type-builder CTB routes are not configured, allowing unauthorized access to the affected resources...

CVE-2020-27665: Incorrect Default Permissions

In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...

PT-2020-16757

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 3.2.5 Description The issue arises from the lack of admin::hasPermissions restriction for CTB content-type-builder routes. This means that there are no proper access controls in place for these specific routes,...