Read the docs
TI-2023-09037 Aliases CVE-2023-22894GHSA-jjqf-j4w7-92w8

Query filter flaw in Strapi exposes sensitive user details

Priority CRITICAL 91Exploited in the wildCWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-312.

Summary

@strapi/strapi from 3.2.1 before 4.8.0 (npm) lets an attacker with admin panel access abuse the query filter to reveal sensitive user data. The attacker filters users by sensitive columns and infers values from API responses, which exposes password hashes and password reset tokens when the attacker has super admin access. The flaw is listed in CISA KEV, with a date added of 2026-10-08.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-08CISA due date 2026-10-11
EPSS 0.04114 90th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed @strapi/strapi (npm): 4.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—@strapi/strapi (npm)3.2.1 to before 4.8.04.8.0Patch availableGHSA-jjqf-j4w7-92w8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • @strapi/strapi (npm) Vendor— Affected 3.2.1 to before 4.8.0 Fixed in 4.8.0 Patch available GHSA-jjqf-j4w7-92w8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*3.2.1 to before 4.8.0VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* Versions 3.2.1 to before 4.8.0 Vulnerable ·Strapi

Remediation

Upgrade @strapi/strapi to version 4.8.0. CISA requires U.S. federal agencies to fix it by 2026-10-11.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · GHSA-jjqf-j4w7-92w8 @strapi/strapi (npm) Fixed in 4.8.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22894
  2. 2026-10-03 Alias added: GHSA-jjqf-j4w7-92w8
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-07 CISA SSVC decision points changed
  5. 2026-10-08 Added to CISA KEV
  6. 2026-10-08 CVSS score changed · CISA ADP
  7. 2026-10-08 CISA SSVC decision points changed
  8. 2026-10-08 Priority changed: MEDIUM → LOW
  9. 2026-10-08 CISA SSVC decision points changed
  10. 2026-10-08 Priority changed: LOW → CRITICAL
  11. 2026-10-09 CISA SSVC decision points changed
  12. 2026-10-09 CISA KEV entry updated
  13. 2026-10-25 EPSS moved to the 90th–95th percentile

References

Exploit 2

Advisory 1

Other 5

  • TI-2019-13554 strapi before 3.0.0-beta.17.5 mishandles password resets within… CVSS 3.1CRITICAL 9.8
  • TI-2023-19887 Strapi Improper Rate Limiting vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-08803 Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can… CVSS 3.1CRITICAL 10.0
  • TI-2024-25161 Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 8.6
  • TI-2023-17071 Leaking sensitive user information still possible by filtering on private with prefix fields CVSS 3.1HIGH 8.6
  • TI-2024-37136 Strapi Allows Unauthorized Access to Private Fields via parms.lookup CVSS 3.1HIGH 8.2
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences