Strapi: Sensitive user data disclosure via query filter in admin panel
Deadline for US federal agencies: 11 Oct 2026
Summary
Strapi, an open-source headless CMS, lets users with admin panel access filter users by sensitive columns through the query filter and infer values from API responses. A super admin can thereby obtain password hashes and password reset tokens of all users, while a lower-privileged role with access to user data can read usernames and email addresses of API users only. CISA lists the vulnerability as actively exploited, and it can be chained with CVE-2023-22621 to achieve remote code execution.
Affected
- Strapi through 4.5.5 according to NVD
- Strapi 3.2.1 up to 4.8.0 according to GitHub and GitLab advisories
- Some third-party sites list up to 4.7.1; treat 4.7.x as potentially affected
Unknown: exact range, to be confirmed with the vendor advisory
Fixed in
- Upgrade to Strapi 4.8.0 or later
- Strapi 3.x reached end of life on 31 December 2022 and receives no security updates; migrate to a supported major version
Workaround
Unknown. No vendor-documented workaround; the upgrade is the remedy.
- Interim hardening (not from vendor): restrict admin panel access to trusted IP ranges or a VPN; enforce MFA and strong passwords for admin accounts; limit which roles can query user fields; reduce admin accounts to the minimum
Exploitation
- CISA KEV: known exploited, added 2026-10-08, due 2026-10-11
- Public proof-of-concept code is listed on exploit-intel; not reviewed
- CISA states the flaw can be chained with CVE-2023-22621 to achieve remote code execution
- Attacker needs admin panel access (CVSS PR:H)
Our recommendation
- Patch to Strapi 4.8.0 or later as a priority
- If the instance is on a line that cannot move directly to 4.8.0, plan a migration to a supported major version with compatibility testing
- Also patch CVE-2023-22621 (Strapi 4.5.6 or later)
- Review admin accounts and roles, enforce MFA, and reset passwords and tokens if exposure is suspected
- Restrict the admin panel to trusted networks and monitor admin logins
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (2 repositories)
Saboor-Hakimi/CVE-2023-22894 · maxntv/CVE-2023-22894-PoC
Research sources
- Strapi security disclosure (April 2023) strapi.io
- Strapi releases github.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- GitLab advisory CVE-2023-22894 advisories.gitlab.com
- Researcher blog: Strapi vulnerabilities www.ghostccamm.com
- CVE-2023-22894 on cve-security.com cve-security.com
- Exploit-intel CVE-2023-22894 exploit-intel.com
- Security Affairs: CISA KEV additions securityaffairs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:50.
Original description (NVD)
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (7)
- https://github.com/strapi/strapi/releases
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
- https://www.ghostccamm.com/blog/multi_strapi_vulns/
- https://github.com/strapi/strapi/releases
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
- https://www.ghostccamm.com/blog/multi_strapi_vulns/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.