Read the docs
TI-2022-12753 Aliases CVE-2022-30617GHSA-f6fm-r26q-p747

An authenticated user with access to the Strapi admin panel can view private and…

Priority MEDIUM 41CWE-212Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin” that has updated one of the author’s blog posts. There are also many other scenarios where such details from other users can leak in the JSON response, either through a direct or indirect relationship. Access to this information enables a user to compromise other users’ accounts by successfully invoking the password reset workflow. In a worst-case scenario, a low-privileged user could get access to a “super admin” account with full control over the Strapi instance, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.

Why it matters now

EPSS 0.01473 73rd percentileScored 2026-11-07
Fix Fixed Strapi (Strapi): 3.6.9, 4.0.0-beta.16strapi (npm): 3.6.9+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
StrapiStrapibefore 3.6.9; ! 4.0.0; before 4.0.0-beta.163.6.9, 4.0.0-beta.16Patch availableCNA
—strapi (npm)3.0.0 to before 3.6.93.6.9Patch availableGHSA-f6fm-r26q-p747
—@strapi/strapi (npm)before 4.0.0-beta.154.0.0-beta.15Patch availableGHSA-f6fm-r26q-p747
  • Strapi VendorStrapi Affected before 3.6.9; ! 4.0.0; before 4.0.0-beta.16 Fixed in 3.6.9, 4.0.0-beta.16 Patch available CNA
  • strapi (npm) Vendor— Affected 3.0.0 to before 3.6.9 Fixed in 3.6.9 Patch available GHSA-f6fm-r26q-p747
  • @strapi/strapi (npm) Vendor— Affected before 4.0.0-beta.15 Fixed in 4.0.0-beta.15 Patch available GHSA-f6fm-r26q-p747

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*3.0.0 to before 3.6.10VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta10:*:*:*:*:*:*4.0.0 beta10VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta11:*:*:*:*:*:*4.0.0 beta11VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta12:*:*:*:*:*:*4.0.0 beta12VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta13:*:*:*:*:*:*4.0.0 beta13VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta14:*:*:*:*:*:*4.0.0 beta14VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta15:*:*:*:*:*:*4.0.0 beta15VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta2:*:*:*:*:*:*4.0.0 beta2VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta3:*:*:*:*:*:*4.0.0 beta3VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta4:*:*:*:*:*:*4.0.0 beta4VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.6.10 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta10:*:*:*:*:*:* Versions 4.0.0 beta10 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta11:*:*:*:*:*:* Versions 4.0.0 beta11 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta12:*:*:*:*:*:* Versions 4.0.0 beta12 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta13:*:*:*:*:*:* Versions 4.0.0 beta13 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta14:*:*:*:*:*:* Versions 4.0.0 beta14 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta15:*:*:*:*:*:* Versions 4.0.0 beta15 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta2:*:*:*:*:*:* Versions 4.0.0 beta2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta3:*:*:*:*:*:* Versions 4.0.0 beta3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta4:*:*:*:*:*:* Versions 4.0.0 beta4 Vulnerable ·Strapi
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:4.0.0:beta5:*:*:*:*:*:*4.0.0 beta5VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta6:*:*:*:*:*:*4.0.0 beta6VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta7:*:*:*:*:*:*4.0.0 beta7VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta8:*:*:*:*:*:*4.0.0 beta8VulnerableStrapi
cpe:2.3:a:strapi:strapi:4.0.0:beta9:*:*:*:*:*:*4.0.0 beta9VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta5:*:*:*:*:*:* Versions 4.0.0 beta5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta6:*:*:*:*:*:* Versions 4.0.0 beta6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta7:*:*:*:*:*:* Versions 4.0.0 beta7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta8:*:*:*:*:*:* Versions 4.0.0 beta8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:4.0.0:beta9:*:*:*:*:*:* Versions 4.0.0 beta9 Vulnerable ·Strapi

Remediation

  • Fix · CNA Strapi (Strapi) Fixed in 3.6.9, 4.0.0-beta.16
  • Fix · GHSA-f6fm-r26q-p747 strapi (npm) Fixed in 3.6.9 Advisory →
  • Fix · GHSA-f6fm-r26q-p747 @strapi/strapi (npm) Fixed in 4.0.0-beta.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30617
  2. 2026-10-03 Alias added: GHSA-f6fm-r26q-p747

References

Advisory 2

Other 1

  • TI-2023-09037 Query filter flaw in Strapi exposes sensitive user details KEVCVSS 3.1HIGH 7.2
  • TI-2019-13554 strapi before 3.0.0-beta.17.5 mishandles password resets within… CVSS 3.1CRITICAL 9.8
  • TI-2023-19887 Strapi Improper Rate Limiting vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-08803 Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can… CVSS 3.1CRITICAL 10.0
  • TI-2024-25161 Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 8.6
  • TI-2023-17071 Leaking sensitive user information still possible by filtering on private with prefix fields CVSS 3.1HIGH 8.6
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences