{"id":"CVE-2019-18818","aliases":["EUVD-2019-0783","GHSA-6xc2-mj39-q599"],"status":"published","title":"Strapi allows unauthenticated attacker to reset admin password without valid reset token","description":"strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.97476,"percentile":0.999,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-640"],"published":"2019-11-07T21:02:58Z","modified":"2026-10-20T10:51:04Z","exploits":[{"source":"pocgithub","id":"guglia001/CVE-2019-18818","title":"guglia001/CVE-2019-18818","date":"2021-08-29","url":"https://github.com/guglia001/CVE-2019-18818"},{"source":"exploitdb","id":"EDB-50237","title":"Strapi 3.0.0-beta - Set Password (Unauthenticated)","type":"webapps","platform":"multiple","date":"2021-08-30","url":"https://www.exploit-db.com/exploits/50237"},{"source":"pocgithub","id":"rasyidfox/CVE-2019-18818","title":"rasyidfox/CVE-2019-18818","date":"2021-10-11","url":"https://github.com/rasyidfox/CVE-2019-18818"},{"source":"exploitdb","id":"EDB-50716","title":"Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)","type":"webapps","platform":"nodejs","date":"2022-02-08","url":"https://www.exploit-db.com/exploits/50716"},{"source":"pocgithub","id":"hadrian3689/strapi_cms_3.0.0-beta.17.7","title":"hadrian3689/strapi_cms_3.0.0-beta.17.7","date":"2022-03-10","url":"https://github.com/hadrian3689/strapi_cms_3.0.0-beta.17.7"},{"source":"pocgithub","id":"Hackhoven/Strapi-RCE","title":"Hackhoven/Strapi-RCE","date":"2024-07-01","url":"https://github.com/Hackhoven/Strapi-RCE"},{"source":"pocgithub","id":"abelsrzz/CVE-2019-18818_CVE-2019-19609","title":"abelsrzz/CVE-2019-18818_CVE-2019-19609","date":"2025-02-16","url":"https://github.com/abelsrzz/CVE-2019-18818_CVE-2019-19609"},{"source":"metasploit","id":"auxiliary/scanner/http/strapi_3_password_reset","title":"Strapi CMS Unauthenticated Password Reset","type":"auxiliary","date":"2022-02-09","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/strapi_3_password_reset"},{"source":"nuclei","id":"CVE-2019-18818","title":"strapi CMS \u003c3.0.0-beta.17.5 - Admin Password Reset","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18818.yaml"}],"fixes":[{"ecosystem":"npm","package":"strapi","fixed_in":["3.0.0-beta.17.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"strapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0-beta.17.4"},{"fixed":"3.0.0-beta.17.5"}]}]},{"source":"osv","ecosystem":"npm","package":"strapi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0-beta.17.5"}]}]}],"products":[{"vendor":"strapi","product":"strapi"}],"references":[{"url":"https://github.com/strapi/strapi/pull/4443","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://www.npmjs.com/advisories/1311","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18818","tags":["advisory"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18818","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6xc2-mj39-q599"},{"url":"https://github.com/strapi/strapi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-18818","description":"strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.","status":"published","published":"2019-11-07T21:02:58Z","modified":"2024-08-05T02:02:39.859Z","updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-0783","description":"strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.","status":"published","published":"2019-11-07T21:02:58Z","modified":"2024-08-05T02:02:39Z","updated_at":"2026-11-03T02:40:27.303586Z"}],"ghsa":[{"id":"GHSA-6xc2-mj39-q599","title":"Strapi allows unauthenticated attacker to reset admin password without valid reset token","description":"Versions of `strapi` prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.\n\n\n## Recommendation\n\nUpgrade to version 3.0.0-beta.17.5 or later.","status":"published","published":"2019-12-02T18:20:41Z","modified":"2023-01-27T05:02:26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2019-18818","description":"strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.","status":"published","published":"2019-11-07T22:15:10.57Z","modified":"2026-06-17T02:25:23.883Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:05:35.052973Z"}],"osv":[{"id":"CVE-2019-18818","description":"strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.","status":"published","published":"2019-11-07T22:15:10.57Z","modified":"2026-10-20T10:51:04.590536277Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-6xc2-mj39-q599","title":"Strapi allows unauthenticated attacker to reset admin password without valid reset token","description":"Versions of `strapi` prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.\n\n\n## Recommendation\n\nUpgrade to version 3.0.0-beta.17.5 or later.","status":"published","published":"2019-12-02T18:20:41Z","modified":"2023-11-08T04:01:26.332116Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}