CVE-2023-36472
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
- Record
CVE-2023-36472- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-2598
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
- Record
EUVD-2023-2598- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v8gg-4mq2-88q4
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Summary
I can get access to user reset password tokens if I have the configure view permissions
Details
/content-manager/relations route does not remove private fields or ensure that they can't be selected
PoC
Install fresh strapi instance start up strapi and create an account create a new content-type give the content-type a relation with admin users and save go to Admin panel roles Author and then plugins. Enable for content-manager collection types the configure view In the collection time now only give them access to the collection you created for this. Create a new admin user account with the Author role Log out and request a password reset for the main admin user. Login on the newly created account go to the collection type you created for this test and click the create new entry button, click in the create new entry view on configure view. select the admin user relation we created click on resetPasswordToken Now go back to the create an entry view and when selection the relation we created we now see the reset tokken
Impact
Impact is that the none admin user now has the reset token of the admin users account and can resets its password using that to escalate his privilege's
Still you need the configure view permission to be able to escalate your privilege's
- Record
GHSA-v8gg-4mq2-88q4- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
- Record
CVE-2023-36472- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N - CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
- Record
CVE-2023-36472- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-v8gg-4mq2-88q4
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Summary
I can get access to user reset password tokens if I have the configure view permissions
Details
/content-manager/relations route does not remove private fields or ensure that they can't be selected
PoC
Install fresh strapi instance start up strapi and create an account create a new content-type give the content-type a relation with admin users and save go to Admin panel roles Author and then plugins. Enable for content-manager collection types the configure view In the collection time now only give them access to the collection you created for this. Create a new admin user account with the Author role Log out and request a password reset for the main admin user. Login on the newly created account go to the collection type you created for this test and click the create new entry button, click in the create new entry view on configure view. select the admin user relation we created click on resetPasswordToken Now go back to the create an entry view and when selection the relation we created we now see the reset tokken
Impact
Impact is that the none admin user now has the reset token of the admin users account and can resets its password using that to escalate his privilege's
Still you need the configure view permission to be able to escalate your privilege's
- Record
GHSA-v8gg-4mq2-88q4- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@strapi/plugin-content-managernpm |
before 4.11.7 | 4.11.7 |
@strapi/adminnpm |
before 4.11.7 | 4.11.7 |
@strapi/utilsnpm |
before 4.11.7 | 4.11.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36472 is a medium vulnerability (CVSS 5.8) in Strapi, published September 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in @strapi/plugin-content-manager 4.11.7.