CVE-2019-18818

Strapi allows unauthenticated attacker to reset admin password without valid reset token

9.8 CriticalPublic exploitFix available

CVE-2019-18818 is a critical vulnerability (CVSS 9.8) in Strapi, published November 7, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.6%, the 99th percentile. Fixed in strapi 3.0.0-beta.17.5.

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

97.6%Up 96.8 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Record: CVE-2019-18818
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-640
Updated: 2026-11-02

CVE List No score

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Record: CVE-2019-18818
Updated: 2026-11-02

EUVDEUVD-2019-0783 No score

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Record: EUVD-2019-0783
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6xc2-mj39-q599 9.8

Strapi allows unauthenticated attacker to reset admin password without valid reset token

Versions of strapi prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.

Recommendation

Upgrade to version 3.0.0-beta.17.5 or later.

Record: GHSA-6xc2-mj39-q599
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-640
Updated: 2026-11-02

OSV 9.8

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Record: CVE-2019-18818
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-6xc2-mj39-q599 9.8

Strapi allows unauthenticated attacker to reset admin password without valid reset token

Recommendation

Upgrade to version 3.0.0-beta.17.5 or later.

Record: GHSA-6xc2-mj39-q599
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-640
Updated: 2026-11-02

Affected products

strapi

Affected packages

Affected packages
Package	Affected	Fixed
`strapi` npm	through 3.0.0-beta.17.4	3.0.0-beta.17.5
`strapi` npm	before 3.0.0-beta.17.5	3.0.0-beta.17.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Strapi 3.0.0-beta - Set Password (Unauthenticated)	2021-08-30
Exploit-DB	Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)	2022-02-08
Metasploit	Strapi CMS Unauthenticated Password Reset	2022-02-09
Nuclei	strapi CMS <3.0.0-beta.17.5 - Admin Password Reset
PoC in GitHub	Hackhoven/Strapi-RCE	2024-07-01
PoC in GitHub	abelsrzz/CVE-2019-18818_CVE-2019-19609	2025-02-16
PoC in GitHub	guglia001/CVE-2019-18818	2021-08-29
PoC in GitHub	hadrian3689/strapi_cms_3.0.0-beta.17.7	2022-03-10
PoC in GitHub	rasyidfox/CVE-2019-18818	2021-10-11

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

References

Show 4 moreShow less