Vulnerabilities

Filters

1 selected

46 records

Sort

Vendor: Strapi Clear all filters

TI-2026-81503 CVE-2026-118171 · GHSA-hqgm-4px4-m8x2

Missing authorization in Strapi content manager preview URLs

LOW 28

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00248 Published 2026-10-27 No fix listed CWE-862

TI-2026-81504 CVE-2026-118172 · GHSA-q3j4-m5fm-rj65

Server-side request forgery in Strapi webhook runner via redirects

LOW 27

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00224 Published 2026-10-27 No fix listed CWE-918

TI-2026-81502 CVE-2026-118170 · GHSA-5cm6-76xf-w8hq

Strapi review-workflows lets callers update documents without rights

MEDIUM 47

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00287 Published 2026-10-27 No fix listed CWE-862

TI-2026-70527 CVE-2026-108114 · GHSA-wmch-qg2f-grh3

Strapi admin API tokens keep access to removed content fields

MEDIUM 57

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00199 Published 2026-10-10 No fix listed CWE-863

TI-2026-61575 CVE-2026-90561 · GHSA-jh7v-p6jw-jwhc

Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

MEDIUM 42

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.0043 Published 2026-09-13 Fixed in 5.48.1 CWE-79

TI-2026-41759 CVE-2026-57997 · GHSA-93c7-w42j-xh4p

Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration

LOW 28

Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00249 Published 2026-06-29 Fixed in 5.7.0 CWE-327

TI-2026-22230 CVE-2026-27886 · GHSA-rjg2-95x7-8qmx

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

MEDIUM 49

Strapi is an open source headless content management system.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01916 Published 2026-05-14 Fixed in 5.37.0 CWE-200

TI-2026-18234 CVE-2026-22707 · GHSA-pcw7-5633-82vv

Strapi Upload Plugin MIME Validation Bypass via Content API

LOW 29

Strapi is an open source headless content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00195 Published 2026-05-14 Fixed in 5.33.3 CWE-434

TI-2026-18233 CVE-2026-22706 · GHSA-hvp3-26wx-g2w4

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

LOW 11

Strapi is an open source headless content management system.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00341 Published 2026-05-14 Fixed in 5.33.3 CWE-613

TI-2026-18160 CVE-2026-22599 · GHSA-3xcq-8mjw-h6mx

Strapi Vulnerable to SQL Injection in Content Type Builder

MEDIUM 44

Strapi is an open source headless content management system.

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.01178 Published 2026-05-14 Fixed in 5.33.2, 4.26.1 CWE-89

TI-2025-39916 CVE-2025-64526 · GHSA-7mqx-wwh4-f9fw

Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

LOW 39

Strapi is an open source headless content management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00492 Published 2026-05-14 Fixed in 5.45.0 CWE-307

TI-2025-33085 CVE-2025-53092 · GHSA-9329-mxxw-qwf8

Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

LOW 29

Strapi is an open source headless content management system.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00289 Published 2025-10-16 Fixed in 5.20.0 CWE-200

TI-2025-18952 CVE-2025-25298 · GHSA-2cjv-6wg9-f4f3

Missing Maximum Password Length Validation in Strapi Password Hashing

MEDIUM 61

Strapi is an open source headless CMS.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.004 Published 2025-10-16 Fixed in 5.10.3 CWE-261

TI-2024-37136 CVE-2024-56143 · GHSA-495j-h493-42q2

Strapi Allows Unauthorized Access to Private Fields via parms.lookup

HIGH 75

Strapi is an open-source headless content management system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00418 Published 2025-10-16 Fixed in 5.5.2 CWE-639

TI-2025-03475 CVE-2025-3930 · GHSA-4r8w-3jww-m2rp

Lack of JWT Expiration after Log Out in Strapi

LOW 29

Strapi uses JSON Web Tokens (JWT) for authentication.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00695 Published 2025-10-16 Fixed in 5.24.1 CWE-613

TI-2024-35248 CVE-2024-52588 · GHSA-v8wj-f5c7-pvxf

Strapi allows Server-Side Request Forgery in Webhook function

HIGH 66

Strapi is an open-source content management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00586 Published 2025-05-29 Fixed in 4.25.2 CWE-918

TI-2024-25161 CVE-2024-37818 · GHSA-p9ff-j98v-p435

Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the…

HIGH 76

Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00556 Published 2024-06-20 No fix listed CWE-918

TI-2024-22523 CVE-2024-34065 · GHSA-wrvh-rcmr-9qfc

@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass

LOW 36

Strapi is an open-source content management system.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00704 Published 2024-06-12 Fixed in 4.24.2 CWE-294

TI-2024-20594 CVE-2024-31217 · GHSA-pm9q-xj9p-96pm

@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling

MEDIUM 62

Strapi is an open-source content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00736 Published 2024-06-12 Fixed in 4.22.0 CWE-248

TI-2024-19350 CVE-2024-29181 · GHSA-6j89-frxc-q26m

@strapi/plugin-content-manager leaks data via relations via the Admin Panel

MEDIUM 50

Strapi is an open-source content management system.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00385 Published 2024-06-12 Fixed in 4.19.1 CWE-639

TI-2023-26082 CVE-2023-48218 · GHSA-6h67-934r-82g7

Incorrect authorization in strapi-community strapi-plugin-protected-populate

LOW 25

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00601 Published 2023-11-20 Fixed in 1.3.4 CWE-863

TI-2023-20484 CVE-2023-39345 · GHSA-gc7p-j5xm-xxh2

Unauthorized Access to Private Fields in User Registration API in strapi

HIGH 66

strapi is an open-source headless CMS.

CVSS 3.1HIGH 7.6 Adjacent network No auth No interaction EPSS 0.00593 Published 2023-11-06 Fixed in 4.13.1 CWE-287

TI-2023-19887 CVE-2023-38507 · GHSA-24q2-59hm-rh9r

Strapi Improper Rate Limiting vulnerability

HIGH 81

Strapi is the an open-source headless content management system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00963 Published 2023-09-15 Fixed in 4.12.1 CWE-770

TI-2023-18893 CVE-2023-37263 · GHSA-m284-85mf-cgrc

Strapi's field level permissions not being respected in relationship title

MEDIUM 63

Strapi is the an open-source headless content management system.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00635 Published 2023-09-15 Fixed in 4.12.1 CWE-200

TI-2023-18313 CVE-2023-36472 · GHSA-v8gg-4mq2-88q4

Strapi may leak sensitive user information, user reset password, tokens via content-manager views

MEDIUM 59

Strapi is an open-source headless content management system.

CVSS 3.1MEDIUM 5.8 Network Low privileges User interaction EPSS 0.00672 Published 2023-09-15 Fixed in 4.11.7 CWE-200