CVE-2026-90561

Strapi, the popular open-source headless CMS, fails to strip script tags from rich text rendered by the content manager's WYSIWYG preview component. An authenticated user with the low-privileged Author role can save malicious script tags into rich text fields; when an Editor or Super Admin expands the preview pane, the script executes in their session with full admin privileges, enabling account takeover. All Strapi 4.x releases through 4.26.2 and all 5.x releases before 5.48.1 are affected, particularly deployments with multi-role editorial workflows. No public proof of concept is known, the flaw is not on CISA's KEV list, and no in-the-wild exploitation has been reported at this time.

What to do: Upgrade to Strapi 5.48.1 or later; note that 4.26.2 is the final 4.x release and remains vulnerable, so 4.x deployments must migrate to the patched 5.x line. Until patched, restrict Author-role write access to rich-text fields and audit existing content for injected script tags. Also review admin accounts, API tokens, and audit logs for signs of session hijacking or unauthorized token creation following the fix.