CVE-2023-22894Medium· 4.9▾ TwilightPoC availableStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 27 · likelihood 0.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.7%
2 GitHub repos (last check)
9.8 → 4.9
critical → medium
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
strapi >= 3.2.1, < 4.8.0Upgrade past the affected range:
strapi 4.8.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90561High· 8.7Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text
CVE-2022-32114High· 8.8An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file
CVE-2026-67236High· 8.2RabbitMQ is a messaging and streaming broker
CVE-2026-96549Low· 3.3A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8
CVE-2026-77250Medium· 6.1MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)
CVE-2026-63406Medium· 5.9AnyCable is a realtime server for reliable two-way communication that supports any backend