Zero Radar
← feed
CriticalVulnerabilityCVE-2023-22894updated 25 Oct 2026, 17:35 UTC

Strapi CMS leaks admin and user details to anyone via query filters

Attackers who can reach the Strapi admin login page can ask it sneaky questions and get back private account details, including password reset codes. With those codes they can take over admin accounts.

Exploited (CISA KEV)Fixed in @strapi/strapi 4.8.0Official, 2 sources
SeverityCriticalCVSS 7.5 of 10
Being exploited?YesConfirmed by CISA KEV · 8 Oct 2026,
Fix available?Yes@strapi/strapi 4.8.0 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo login needed to start
  2. 2Crafted GET requestFilters users by email or password fields
  3. 3Strapi API respondsResponse changes reveal hidden values
  4. 4Reset token leakedPassword reset token exposed
  5. 5Admin password changedAttacker resets the admin password
  6. ResultAttacker gains Super Administrator access

What happened

Strapi through 4.7.1 lets unauthenticated users filter user records by sensitive columns (email, password, reset_password_token) and infer their values from API response changes, which is cleartext storage/exposure of sensitive data.

Why it is dangerous: An attacker can leak password hashes and reset tokens, then reset the admin password and gain Super Administrator access. CISA reports it can be chained with CVE-2023-22621 for remote code execution.

Are you affected?

You are affected if you run Strapi (npm package @strapi/strapi) version 3.2.1 up to but not including 4.8.0, especially if the admin panel or API is reachable from the internet.

Package / productAffected versionsFixed in
@strapi/strapi · npm>= 3.2.1, < 4.8.04.8.0

What to do

  1. Upgrade @strapi/strapi to version 4.8.0 or later
  2. Search your web server and access logs for the IoC pattern: (\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)
  3. If matches exist, treat it as a possible breach: rotate admin passwords, invalidate reset tokens, and start incident response
  4. If you cannot upgrade, discontinue use of the affected version or restrict admin panel access to trusted networks

Timeline

  1. 19 Apr 2023, 21:41 UTC
    Publicly disclosed
  2. 8 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fixed version published: @strapi/strapi 4.8.0 · GitHub Advisory
  5. 25 Oct 2026, 17:35 UTC
    Fix: @strapi/strapi 4.8.0

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2023-22894 · GHSA-jjqf-j4w7-92w8
CVSS
7.5 / 10
EPSS
4.1% chance of exploitation within 30 days
Disclosed
19 Apr 2023, 21:41 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Strapi CMS leaks admin and user details to anyone via query filters · Zero Radar