CVE-2023-22894
published 2023-04-19CVE-2023-22894: Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can…
PriorityP276medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-10-11
Exploited in the wild
EPSS
3.61%
89.4th percentile
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| strapi | strapi | >= 3.2.1 < 4.8.0 | 4.8.0 |
| strapi | strapi | >= 3.2.1 < 4.8.0 | 4.8.0 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
ghsa4.9MEDIUM
osv4.9MEDIUM
vulncheck7.2HIGH
cisa7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Strapi up to 4.5.5 API information disclosure
vuldb·2026-10-08·CVSS 4.9
CVE-2023-22894 [MEDIUM] Strapi up to 4.5.5 API information disclosure
A vulnerability, which was classified as problematic, was found in Strapi up to 4.5.5. Affected is an unknown function of the component API. The manipulation results in information disclosure.
This vulnerability is known as CVE-2023-22894. Access to the local network is required for this attack. Furthermore, an exploit is available.
You should upgrade the affected component.
OSV
Strapi leaking sensitive user information by filtering on private fields
osv·2023-04-19·CVSS 4.9
CVE-2023-22894 [MEDIUM] Strapi leaking sensitive user information by filtering on private fields
Strapi leaking sensitive user information by filtering on private fields
### Summary
Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users.
### Details
Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. The unauthenticated attacker can filter users by columns that contain sensitive information and infer the values by the changes in the API responses. An unauthenticated attacker can exploit this vulnerability to hijack Strapi administrator accounts and gain unauthorized Strapi Super Administrator access by leaking the password reset token and changing the admin password. This can be exploited on all Strapi versions <=4.7.1.
### IoC
T
GHSA
Strapi leaking sensitive user information by filtering on private fields
ghsa·2023-04-19·CVSS 4.9
CVE-2023-22894 [MEDIUM] CWE-312 Strapi leaking sensitive user information by filtering on private fields
Strapi leaking sensitive user information by filtering on private fields
### Summary
Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users.
### Details
Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. The unauthenticated attacker can filter users by columns that contain sensitive information and infer the values by the changes in the API responses. An unauthenticated attacker can exploit this vulnerability to hijack Strapi administrator accounts and gain unauthorized Strapi Super Administrator access by leaking the password reset token and changing the admin password. This can be exploited on all Strapi versions <=4.7.1.
### IoC
T
VulnCheck
Strapi Cleartext Storage of Sensitive Information Vulnerability
vulncheck·2023·CVSS 7.2
CVE-2023-22894 [HIGH] CWE-312 Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Affected: Strapi Strapi
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO
CISA
Strapi Cleartext Storage of Sensitive Information Vulnerability
cisa·2026-10-08·CVSS 7.2
CVE-2023-22894 [HIGH] CWE-312 Strapi Cleartext Storage of Sensitive Information Vulnerability
Vulnerability: Strapi Cleartext Storage of Sensitive Information Vulnerability
Affected: Strapi Strapi
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow
No detection rules found.
No public exploits indexed.
https://github.com/strapi/strapi/releaseshttps://strapi.io/blog/security-disclosure-of-vulnerabilities-cvehttps://www.ghostccamm.com/blog/multi_strapi_vulns/https://github.com/strapi/strapi/releaseshttps://strapi.io/blog/security-disclosure-of-vulnerabilities-cvehttps://www.ghostccamm.com/blog/multi_strapi_vulns/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894
2023-04-19
Published
2026-10-08
Added to CISA KEV
Exploited in the wild