GHSA-jjqf-j4w7-92w8 CVE-2023-22894

Strapi leaking sensitive user information by filtering on private fields

Medium Known exploited npm

Severity: 7.5 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 4.11%; Chance of exploitation in the next 30 days. Higher than 90.78% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Oct 8, 2026
Weakness: CWE-312 Cleartext Storage of Sensitive Information
Fix: 4.8.0; Upgrade @strapi/strapi to this version or later

Exploited in the wild. Strapi Cleartext Storage of Sensitive Information Vulnerability (Strapi Strapi). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Oct 11, 2026.

Description

Summary

Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users.

Details

Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. The unauthenticated attacker can filter users by columns that contain sensitive information and infer the values by the changes in the API responses. An unauthenticated attacker can exploit this vulnerability to hijack Strapi administrator accounts and gain unauthorized Strapi Super Administrator access by leaking the password reset token and changing the admin password. This can be exploited on all Strapi versions <=4.7.1.

IoC

The exploitation of CVE-2023-22894 is easily detectable, since the payload is within the GET parameters and are normally included in request logs. The following regex pattern will extract requests that are exploiting this vulnerability to leak user's email, password and password reset token columns.

You can search log files for this IoC by using the following grep command.

If the above regex pattern matches any lines in your log files, take extra precaution to look out for multiple requests that include password, reset_password_token or resetPasswordToken. This would indicate that an attacker has leaked the password hashes and reset tokens on your Strapi server and you need to immediately start an incident response!

Impact

All Strapi users below 4.8.0

Affected versions

npm

Package	Vulnerable	Fixed in
@strapi/strapi	`>= 3.2.1, < 4.8.0`	`4.8.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

@strapi/strapi npm → `4.8.0`

npm

npm install @strapi/strapi@4.8.0

yarn

yarn add @strapi/strapi@4.8.0

pnpm

pnpm add @strapi/strapi@4.8.0

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-312: Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

How to prevent it

Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
Implementation, System Configuration, Operation: In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

References

Advisories

Packages

github.com/strapi/strapi

Timeline

Apr 19, 2023 Published
Oct 8, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Oct 9, 2026 Last updated by the source
Oct 11, 2026 Remediation due for U.S. federal agencies
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans	Medium	Same weakness, CWE-312
GHSA-r6w9-259g-gwrv Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access	High	Same weakness, CWE-312
GHSA-pvgv-gcp7-v38g Nginx UI: Node Secret Credential Exposure via URL Query Parameter	High	Same weakness, CWE-312
GHSA-g5xv-mhgm-v5f6 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions	Medium	Same weakness, CWE-312
GHSA-88f6-4rjv-x774 Vikunja: TOTP secret is readable after enrollment, no step-up auth	Medium	Same weakness, CWE-312
EEF-CVE-2026-77970 Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions	Not rated yet	Same weakness, CWE-312
EEF-CVE-2026-75847 Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail	Not rated yet	Same weakness, CWE-312
PYSEC-2026-3792 openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644)…	High	Same weakness, CWE-312

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor