Curated security research, vulnerabilities, advisories and tools for practitioners.

← back | CVE Intelligence

CVE-2026-27886 [High]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-27886.

CVSS: 7.5
Coverage Span: 2026-05-22
Reports: 1 related reports

Associated Reports & Timeline

CVE-2026-27886: Unauthenticated Boolean-Oracle Exfiltration of Administrator Secrets in Strapi

CVE-2026-27886 is a Strapi 4.0.0–5.36.1 sanitization bypass that turns API responses into a one-bit oracle; attackers extract an admin's reset token character by character, then take over the account.