CVE-2024-29181: 
JavaScript vulnerability analysis and mitigation

A vulnerability was discovered in Strapi, an open-source content management system, affecting versions prior to 4.19.1. The vulnerability allows users with Author Role to view associated items they did not create through collection associations, which should be restricted to only their own created items (Strapi Advisory).

The vulnerability occurs when a super admin creates a collection where an item has an association with another collection. In this scenario, users with Author Role can access the list of associated items created by other users through dropdown menus, despite permission settings intended to restrict access to only their own created items. The vulnerability has been assigned a CVSS v3.1 base score of 2.3 (LOW) with the vector string CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N (Strapi Advisory).

The security vulnerability allows authors to access protected data created by administrators through collection associations. This could potentially expose sensitive information such as passwords, emails, or any other items created within the admin's collection, even though the top-level permissions are properly enforced (Strapi Advisory).

The vulnerability requires an authenticated user with Author Role permissions to exploit. The attack complexity is considered high, requiring adjacent network access and user interaction. The exploit involves accessing the content management interface and creating new items with associations to view unauthorized data through dropdown menus (Strapi Advisory).

Users should upgrade to Strapi version 4.19.1 or later, which contains a patch for this vulnerability. The fix specifically updates the @strapi/plugin-content-manager to address the permission handling for associated items (Strapi Advisory, Strapi Patch).