{"id":"CVE-2025-53092","aliases":["EUVD-2025-34775","GHSA-9329-mxxw-qwf8"],"status":"published","title":"Strapi core vulnerable to sensitive data exposure via CORS misconfiguration","description":"Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00289,"percentile":0.2168,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-284","CWE-364","CWE-942"],"published":"2025-10-16T16:29:35Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"npm","package":"@strapi/core","fixed_in":["5.20.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@strapi/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@strapi/core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.20.0"}]}]}],"products":[{"vendor":"strapi","product":"strapi"}],"references":[{"url":"https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53092","tags":["advisory"]},{"url":"https://github.com/strapi/strapi/commit/6e535cb756","tags":["web"]},{"url":"https://github.com/strapi/strapi/releases/tag/v5.20.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9329-mxxw-qwf8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53092.json","tags":["advisory"]},{"url":"https://github.com/strapi/strapi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-53092","title":"Strapi core vulnerable to sensitive data exposure via CORS misconfiguration","description":"Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.","status":"published","published":"2025-10-16T16:29:35.246Z","modified":"2025-10-16T18:13:08.618Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-284","CWE-364","CWE-942"],"updated_at":"2026-11-02T14:32:48.853452Z"}],"euvd":[{"id":"EUVD-2025-34775","description":"Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.","status":"published","published":"2025-10-16T16:29:35Z","modified":"2025-10-16T18:13:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:31.065489Z"}],"ghsa":[{"id":"GHSA-9329-mxxw-qwf8","title":"Strapi core vulnerable to sensitive data exposure via CORS misconfiguration","description":"### Summary\n\nA CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses.\n\n### Technical Details\n\nBy default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting.\n\nExample:\n`Origin: http://localhost:8888`\n`Access-Control-Allow-Origin: http://localhost:8888`\n`Access-Control-Allow-Credentials: true`\n\nThis allows an attacker-controlled site (on a different port, like 8888) to send credentialed requests to the Strapi backend on 1337.\n\n### Suggested Fix\n\n1. Explicitly whitelist trusted origins\n2. Avoid reflecting dynamic origins","status":"published","published":"2025-10-16T19:49:01Z","modified":"2026-01-29T03:59:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-284","CWE-364","CWE-942"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2025-53092","description":"Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.","status":"published","published":"2025-10-16T17:15:33.727Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-284","CWE-364","CWE-942"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"CVE-2025-53092","title":"Strapi core vulnerable to sensitive data exposure via CORS misconfiguration","description":"Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.","status":"published","published":"2025-10-16T16:29:35.246Z","modified":"2026-10-28T02:31:06.068001951Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284","CWE-364","CWE-942"],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"GHSA-9329-mxxw-qwf8","title":"Strapi core vulnerable to sensitive data exposure via CORS misconfiguration","description":"### Summary\n\nA CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses.\n\n### Technical Details\n\nBy default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting.\n\nExample:\n`Origin: http://localhost:8888`\n`Access-Control-Allow-Origin: http://localhost:8888`\n`Access-Control-Allow-Credentials: true`\n\nThis allows an attacker-controlled site (on a different port, like 8888) to send credentialed requests to the Strapi backend on 1337.\n\n### Suggested Fix\n\n1. Explicitly whitelist trusted origins\n2. Avoid reflecting dynamic origins","status":"published","published":"2025-10-16T19:49:01Z","modified":"2026-02-03T03:03:57.813541Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-284","CWE-364","CWE-942"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}