CVE-2023-22894Medium· 4.9▾ Midnight⚠ Exploited in the wildPoC availableStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 27 · likelihood 0.8 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.7%
9.8 → 4.9
critical → medium
Federal remediation due Oct 11, 2026
Last analysed / modified upstream
1.7% → 4.1%
2 GitHub repos (last check)
Added to the CISA catalog on Oct 8, 2026. Federal remediation due Oct 11, 2026. View catalog ↗
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
strapi >= 3.2.1, < 4.8.0Upgrade past the affected range:
strapi 4.8.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108114Medium· 4.3Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted
CVE-2026-90561High· 8.7Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text
CVE-2022-32114High· 8.8An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file
CVE-2025-64526Medium· 5.3Strapi is an open source headless content management system
CVE-2026-118170NoneCVE-2026-118170
CVE-2026-118172NoneCVE-2026-118172