Strapi Strapi vulnerabilities

• strapi open source and enterprise headless cms CVE-2026-118171 CVE-2026-118171 6.5 MediumOctober 27, 2026
• strapi open source and enterprise headless cms CVE-2026-118172 CVE-2026-118172 6.1 MediumOctober 27, 2026
• strapi open source and enterprise headless cms CVE-2026-118170 CVE-2026-118170 9.1 CriticalOctober 27, 2026
• strapi Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions CVE-2026-108114 5.3 MediumOctober 10, 2026
• strapi Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG CVE-2026-90561 9.3 CriticalSeptember 13, 2026
• strapi Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration CVE-2026-57997 6.3 MediumJune 29, 2026
• strapi Strapi may leak sensitive data via relational filtering due to lack of query sanitization CVE-2026-27886 Public exploitFix available 9.2 CriticalMay 14, 2026
• strapi, strapi @strapi/upload +1 more Strapi Upload Plugin MIME Validation Bypass via Content API CVE-2026-22707 Fix available 5.3 MediumMay 14, 2026
• strapi, strapi @strapi/admin, @strapi/plugin-users-permissions +2 more Strapi: Password Reset Does Not Revoke Existing Refresh Sessions CVE-2026-22706 Public exploitFix available 2.1 LowMay 13, 2026
• strapi, strapi @strapi/content-type-builder +1 more Strapi Vulnerable to SQL Injection in Content Type Builder CVE-2026-22599 Public exploitFix available 9.3 CriticalMay 13, 2026
• strapi, strapi @strapi/plugin-users-permissions +1 more Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying CVE-2025-64526 Fix available 6.9 MediumMay 13, 2026
• strapi Strapi core vulnerable to sensitive data exposure via CORS misconfiguration CVE-2025-53092 Fix available 6.5 MediumOctober 16, 2025
• strapi Missing Maximum Password Length Validation in Strapi Password Hashing CVE-2025-25298 Fix available 6.3 MediumOctober 16, 2025
• strapi Strapi Allows Unauthorized Access to Private Fields via parms.lookup CVE-2024-56143 Fix available 8.2 HighOctober 16, 2025
• strapi Lack of JWT Expiration after Log Out in Strapi CVE-2025-3930 Fix available 6.3 MediumOctober 16, 2025
• strapi Strapi allows Server-Side Request Forgery in Webhook function CVE-2024-52588 Fix available 4.9 MediumMay 27, 2025
• strapi Strapi Server-Side Request Forgery (SSRF) CVE-2024-37818 Disputed 8.6 HighJune 20, 2024
• strapi @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass CVE-2024-34065 Fix available 7.1 HighJune 12, 2024
• strapi @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling CVE-2024-31217 Fix available 5.3 MediumJune 12, 2024
• strapi @strapi/plugin-content-manager leaks data via relations via the Admin Panel CVE-2024-29181 Fix available 2.3 LowJune 12, 2024
• strapi Unauthorized Access to Private Fields in User Registration API in strapi CVE-2023-39345 Fix available 7.6 HighNovember 3, 2023
• strapi Strapi Improper Rate Limiting vulnerability CVE-2023-38507 Fix available 7.3 HighSeptember 13, 2023
• strapi Strapi's field level permissions not being respected in relationship title CVE-2023-37263 Fix available 6.8 MediumSeptember 13, 2023
• strapi Strapi may leak sensitive user information, user reset password, tokens via content-manager views CVE-2023-36472 Fix available 5.8 MediumSeptember 13, 2023
• strapi Leaking sensitive user information still possible by filtering on private with prefix fields CVE-2023-34235 Fix available 8.6 HighJuly 25, 2023
• strapi Strapi allows actors to make all attributes on a content-type public without noticing it CVE-2023-34093 Fix available 4.8 MediumJuly 25, 2023
• strapi Strapi leaking sensitive user information by filtering on private fields CVE-2023-22894 In KEVPublic exploitFix available 4.9 MediumApril 19, 2023
• strapi Strapi does not verify the access or ID tokens issued during the OAuth flow CVE-2023-22893 Fix available 7.5 HighApril 19, 2023
• strapi Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin CVE-2023-22621 Public exploitFix available EPSS 70.6% 7.2 HighApril 19, 2023
• strapi Strapi mishandles hidden attributes within admin API responses CVE-2022-31367 Fix available 8.8 HighSeptember 27, 2022
• strapi Strapi 4.1.12 Cross-site Scripting via crafted file CVE-2022-32114 Public exploitDisputed 8.8 HighJuly 13, 2022
• strapi Cross-site Scripting in Strapi CVE-2022-29894 4.8 MediumJune 13, 2022
• strapi Improper Removal of Sensitive Information Before Storage or Transfer in Strapi CVE-2022-30618 Fix available 7.5 HighMay 19, 2022
• strapi Improper Removal of Sensitive Information Before Storage or Transfer in Strapi CVE-2022-30617 Fix available 8.8 HighMay 19, 2022
• strapi Insecure password handling vulnerability in Strapi CVE-2021-46440 Fix available 7.5 HighMay 3, 2022
• strapi Unrestricted Upload of File with Dangerous Type in Strapi CVE-2022-27263 9.8 CriticalApril 12, 2022
• strapi, strapi strapi/strapi +1 more Arbitrary Command Injection in strapi/strapi CVE-2022-0764 Fix available 6.1 MediumFebruary 26, 2022
• strapi Weak Password Recovery Mechanism for Forgotten Password in Strapi CVE-2021-28128 8.1 HighMay 6, 2021
• strapi Authorization bypass in Strapi CVE-2020-27664 Fix available 9.8 CriticalOctober 22, 2020
• strapi Improper Authorization in Strapi CVE-2020-27665 Fix available 7.5 HighOctober 22, 2020
• strapi Cross-site Scripting in Strapi CVE-2020-27666 Fix available 5.4 MediumOctober 22, 2020
• strapi Improper Input Validation in strapi CVE-2020-13961 Fix available 6.5 MediumJune 19, 2020
• strapi Uncontrolled Resource Consumption in strapi CVE-2020-8123 Fix available 4.9 MediumFebruary 4, 2020
• strapi Duplicate Advisory: OS Command Injection in Strapi CVE-2019-19609 Public exploitFix available EPSS 54.1% 7.2 HighDecember 5, 2019
• strapi Strapi allows unauthenticated attacker to reset admin password without valid reset token CVE-2019-18818 Public exploitFix available EPSS 97.6% 9.8 CriticalNovember 7, 2019