Skip to content
Strapi vulnerabilities
Newest
-
strapi open source and enterprise headless cms
CVE-2026-118171
CVE-2026-118171
No score
-
strapi open source and enterprise headless cms
CVE-2026-118172
CVE-2026-118172
No score
-
strapi open source and enterprise headless cms
CVE-2026-118170
CVE-2026-118170
No score
-
strapi
Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
CVE-2026-108114
5.3 Medium
-
strapi
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
CVE-2026-90561
9.3 Critical
-
strapi
Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration
CVE-2026-57997
6.3 Medium
-
strapi
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
CVE-2026-27886
Public exploitFix available
9.2 Critical
-
strapi, strapi @strapi/upload +1 more
Strapi Upload Plugin MIME Validation Bypass via Content API
CVE-2026-22707
Fix available
5.3 Medium
-
strapi, strapi @strapi/admin, @strapi/plugin-users-permissions +2 more
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
CVE-2026-22706
Public exploitFix available
2.1 Low
-
strapi, strapi @strapi/content-type-builder +1 more
Strapi Vulnerable to SQL Injection in Content Type Builder
CVE-2026-22599
Public exploitFix available
9.3 Critical
-
strapi, strapi @strapi/plugin-users-permissions +1 more
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
CVE-2025-64526
Fix available
6.9 Medium
-
strapi
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
CVE-2025-53092
Fix available
6.5 Medium
-
strapi
Missing Maximum Password Length Validation in Strapi Password Hashing
CVE-2025-25298
Fix available
6.3 Medium
-
strapi
Strapi Allows Unauthorized Access to Private Fields via parms.lookup
CVE-2024-56143
Fix available
8.2 High
-
strapi
Lack of JWT Expiration after Log Out in Strapi
CVE-2025-3930
Fix available
6.3 Medium
-
strapi
Strapi allows Server-Side Request Forgery in Webhook function
CVE-2024-52588
Fix available
4.9 Medium
-
strapi
Strapi Server-Side Request Forgery (SSRF)
CVE-2024-37818
Disputed
8.6 High
-
strapi
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
CVE-2024-34065
Fix available
7.1 High
-
strapi
@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling
CVE-2024-31217
Fix available
5.3 Medium
-
strapi
@strapi/plugin-content-manager leaks data via relations via the Admin Panel
CVE-2024-29181
Fix available
2.3 Low
-
strapi protected populate, strapi-community strapi-plugin-protected-populate +1 more
Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable
CVE-2023-48218
Fix available
5.3 Medium
-
strapi
Unauthorized Access to Private Fields in User Registration API in strapi
CVE-2023-39345
Fix available
7.6 High
-
strapi
Strapi Improper Rate Limiting vulnerability
CVE-2023-38507
Fix available
7.3 High
-
strapi
Strapi's field level permissions not being respected in relationship title
CVE-2023-37263
Fix available
6.8 Medium
-
strapi
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
CVE-2023-36472
Fix available
5.8 Medium
-
strapi
Leaking sensitive user information still possible by filtering on private with prefix fields
CVE-2023-34235
Fix available
8.6 High
-
strapi
Strapi allows actors to make all attributes on a content-type public without noticing it
CVE-2023-34093
Fix available
4.8 Medium
-
strapi
Strapi leaking sensitive user information by filtering on private fields
CVE-2023-22894
In KEVPublic exploitFix available
4.9 Medium
-
strapi
Strapi does not verify the access or ID tokens issued during the OAuth flow
CVE-2023-22893
Fix available
7.5 High
-
strapi
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
CVE-2023-22621
Public exploitFix available
EPSS 70.6%
7.2 High
-
strapi
Strapi mishandles hidden attributes within admin API responses
CVE-2022-31367
Fix available
8.8 High
-
strapi
Strapi 4.1.12 Cross-site Scripting via crafted file
CVE-2022-32114
Public exploitDisputed
8.8 High
-
strapi
Cross-site Scripting in Strapi
CVE-2022-29894
4.8 Medium
-
strapi
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
CVE-2022-30618
Fix available
7.5 High
-
strapi
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
CVE-2022-30617
Fix available
8.8 High
-
strapi
Insecure password handling vulnerability in Strapi
CVE-2021-46440
Fix available
7.5 High
-
strapi
Unrestricted Upload of File with Dangerous Type in Strapi
CVE-2022-27263
9.8 Critical
-
strapi, strapi strapi/strapi +1 more
Arbitrary Command Injection in strapi/strapi
CVE-2022-0764
Fix available
6.1 Medium
-
strapi
Weak Password Recovery Mechanism for Forgotten Password in Strapi
CVE-2021-28128
8.1 High
-
strapi
Authorization bypass in Strapi
CVE-2020-27664
Fix available
9.8 Critical
-
strapi
Improper Authorization in Strapi
CVE-2020-27665
Fix available
7.5 High
-
strapi
Cross-site Scripting in Strapi
CVE-2020-27666
Fix available
5.4 Medium
-
strapi
Improper Input Validation in strapi
CVE-2020-13961
Fix available
6.5 Medium
-
strapi
Uncontrolled Resource Consumption in strapi
CVE-2020-8123
Fix available
4.9 Medium
-
strapi
Duplicate Advisory: OS Command Injection in Strapi
CVE-2019-19609
Public exploitFix available
EPSS 54.1%
7.2 High
-
strapi
Strapi allows unauthenticated attacker to reset admin password without valid reset token
CVE-2019-18818
Public exploitFix available
EPSS 97.6%
9.8 Critical