Read the docs
TI-2022-12754 Aliases CVE-2022-30618GHSA-vgj7-895j-gpr6

An authenticated user with access to the Strapi admin panel can view private and…

Priority LOW 35CWE-212Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.

Why it matters now

EPSS 0.00963 61st percentileScored 2026-11-07
Fix Fixed Strapi (Strapi): 3.6.10, 4.1.10strapi (npm): 3.6.9+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
StrapiStrapibefore 3.6.10; before 4.1.103.6.10, 4.1.10Patch availableCNA
—strapi (npm)3.0.0 to before 3.6.93.6.9Patch availableGHSA-vgj7-895j-gpr6
—@strapi/strapi (npm)before 4.1.94.1.9Patch availableGHSA-vgj7-895j-gpr6
  • Strapi VendorStrapi Affected before 3.6.10; before 4.1.10 Fixed in 3.6.10, 4.1.10 Patch available CNA
  • strapi (npm) Vendor— Affected 3.0.0 to before 3.6.9 Fixed in 3.6.9 Patch available GHSA-vgj7-895j-gpr6
  • @strapi/strapi (npm) Vendor— Affected before 4.1.9 Fixed in 4.1.9 Patch available GHSA-vgj7-895j-gpr6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*3.0.0 to before 3.6.10; 4.0.0 to before 4.1.10VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.6.10; 4.0.0 to before 4.1.10 Vulnerable ·Strapi

Remediation

  • Fix · CNA Strapi (Strapi) Fixed in 3.6.10, 4.1.10
  • Fix · GHSA-vgj7-895j-gpr6 strapi (npm) Fixed in 3.6.9 Advisory →
  • Fix · GHSA-vgj7-895j-gpr6 @strapi/strapi (npm) Fixed in 4.1.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30618
  2. 2026-10-03 Alias added: GHSA-vgj7-895j-gpr6

References

Advisory 2

Other 1

  • TI-2023-09037 Query filter flaw in Strapi exposes sensitive user details KEVCVSS 3.1HIGH 7.2
  • TI-2019-13554 strapi before 3.0.0-beta.17.5 mishandles password resets within… CVSS 3.1CRITICAL 9.8
  • TI-2023-19887 Strapi Improper Rate Limiting vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-08803 Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can… CVSS 3.1CRITICAL 10.0
  • TI-2024-25161 Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 8.6
  • TI-2023-17071 Leaking sensitive user information still possible by filtering on private with prefix fields CVSS 3.1HIGH 8.6
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences