TI-2023-18313 Aliases CVE-2023-36472 GHSA-v8gg-4mq2-88q4

Strapi may leak sensitive user information, user reset password, tokens via content-manager views

MEDIUM 59CWE-200Published 2023-09-15 · Updated 2024-09-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00672 52nd percentileScored 2026-11-08

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed strapi (strapi): 4.11.7@strapi/plugin-content-manager (npm): 4.11.7+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Strapi	strapi	before 4.11.7	4.11.7	Patch available	CNA
—	@strapi/plugin-content-manager (npm)	before 4.11.7	4.11.7	Patch available	GHSA-v8gg-4mq2-88q4
—	@strapi/admin (npm)	before 4.11.7	4.11.7	Patch available	GHSA-v8gg-4mq2-88q4
—	@strapi/utils (npm)	before 4.11.7	4.11.7	Patch available	GHSA-v8gg-4mq2-88q4

strapi VendorStrapi Affected before 4.11.7 Fixed in 4.11.7 Patch available CNA
@strapi/plugin-content-manager (npm) Vendor— Affected before 4.11.7 Fixed in 4.11.7 Patch available GHSA-v8gg-4mq2-88q4
@strapi/admin (npm) Vendor— Affected before 4.11.7 Fixed in 4.11.7 Patch available GHSA-v8gg-4mq2-88q4
@strapi/utils (npm) Vendor— Affected before 4.11.7 Fixed in 4.11.7 Patch available GHSA-v8gg-4mq2-88q4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:strapi:strapi::::::::	before 4.11.7	Vulnerable	Strapi

cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* Versions before 4.11.7 Vulnerable ·Strapi

Remediation

Fix · CNA strapi (strapi) Fixed in 4.11.7
Fix · GHSA-v8gg-4mq2-88q4 @strapi/plugin-content-manager (npm) Fixed in 4.11.7 Advisory →
Fix · GHSA-v8gg-4mq2-88q4 @strapi/admin (npm) Fixed in 4.11.7 Advisory →
Fix · GHSA-v8gg-4mq2-88q4 @strapi/utils (npm) Fixed in 4.11.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-36472
2026-10-03 Alias added: GHSA-v8gg-4mq2-88q4

References

Exploit 1

https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-36472

Other 2

TI-2023-09037 Query filter flaw in Strapi exposes sensitive user details KEVCVSS 3.1HIGH 7.2
TI-2019-13554 strapi before 3.0.0-beta.17.5 mishandles password resets within… CVSS 3.1CRITICAL 9.8
TI-2023-19887 Strapi Improper Rate Limiting vulnerability CVSS 3.1CRITICAL 9.8
TI-2023-08803 Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can… CVSS 3.1CRITICAL 10.0
TI-2024-25161 Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 8.6
TI-2023-17071 Leaking sensitive user information still possible by filtering on private with prefix fields CVSS 3.1HIGH 8.6

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences