Strapi Cleartext Storage of Sensitive Information Vulnerability (CVE-2023-22894)

What is affected, what to do

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses.

The vulnerability is being actively exploited; treat it as a priority. Update Strapi to version 4.8.0. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Strapi lt 3.2.1..4.8.0

Fixed in

• Strapi 4.8.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory all Strapi deployments: identify versions 3.2.1 through 4.7.x (check container images, npm lockfiles, package.json for @strapi/strapi).
   • Upgrade to Strapi 4.8.0 or later; for end-of-life 3.x projects, plan migration and pull the instance off the public internet in the meantime.
   • Place the admin panel (/admin) behind VPN or IP allowlist immediately — never expose it directly, since exploitation requires admin-panel access.
   • Reset all admin and super-admin passwords and invalidate password-reset tokens if any sign of unauthorised admin access exists; treat stored password hashes as potentially compromised.
   • Rotate admin.auth.secret, api-token-salt and all API tokens; a successful exploit may have leaked reset tokens, and chaining with CVE-2023-22621 yields full RCE — audit host-level secret stores accordingly.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: restrict admin routes (/admin, /content-manager, /users-permissions) via reverse proxy (nginx, Traefik) to internal networks; expose only the content API (/api/*) publicly.
   • WAF rule: block or alert on query-string parameters filters[password], filters[resetPasswordToken], filters[email][$contains], and more generally filters[*][$startsWith] / $contains targeting sensitive fields.
   • Least privilege inside the admin panel: audit non-super-admin accounts and remove permissions on the user collection where not strictly needed (Editor/Author roles should not have find/findOne on plugin::users-permissions.user).
   • Database hardening: model password hashes and reset tokens through DB views or dedicated columns so Strapi's query engine cannot filter on them directly; monitor for unusual queries against up_users or admin_users.
   • Establish patch management: enable automated dependency scanning (Dependabot, Renovate) in CI/CD so future Strapi advisories are triaged within 72 hours.
3. 03

   Runbook step 3

   Detection rules

   • Reverse-proxy access-log pattern: GET /content-manager/collection-types/plugin::users-permissions.user?filters*password* or *resetPasswordToken* — treat as high-priority alert.
   • Zeek/Suricata HTTP monitoring: URI contains filters[ combined with (password, resetPasswordToken, confirmationToken, provider); Sigma shape: selection.cs-uri-query|contains|all: ['filters[', 'password'].
   • SIEM correlation: high volume (>50 in 5 min) of HTTP 200 responses to /content-manager/collection-types/*user* from the same admin session indicates brute-force inference via $startsWith filters.
   • Review Strapi admin audit logs for repeated user-collection searches by non-super-admin accounts; if the audit plugin is not deployed, instrument application logs for strapi::content-manager events.
   • Follow-up detection for the CVE-2023-22621 chain: alert on process ancestry node → sh/bash → curl/wget on Strapi hosts via EDR or Sysmon EID 1.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Source: cvelistv5, OSV (Open Source Vulnerabilities), NVD (NIST), CISA KEV Catalog

Vendors and products

• Strapi Strapi

Weakness classes (CWE)

• CWE-312Cleartext Storage of Sensitive Information

  Base

  The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

  Entry at MITRE CWE-312

References & sources

• github.comstrapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8web
• NVD (NIST)vuln/detail/CVE-2023-22894advisory
• github.comstrapi/strapipackage
• github.comstrapi/strapi/releasesweb
• github.comstrapi/strapi/releases/tag/v4.8.0web
• strapi.ioblog/security-disclosure-of-vulnerabilities-cveweb
• ghostccamm.comblog/multi_strapi_vulnsweb
• ghostccamm.comblog/multi_strapi_vulns
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894government-resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 09.10.2026NVD analysis modifiedNVD

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894 Types: US Government Resource

   Source identifier: nvd@nist.gov

2. 09.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2023-22894","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T17:40:11.255802Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2023-22894","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 08.10.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-10-08
   Due Date	added	—	2026-10-08
   Required Action	added	—	2026-10-08
   Vulnerability Name	added	—	2026-10-08

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

4. 08.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894
   SSVC assessment	removed	{"id":"CVE-2023-22894","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T03:55:19.746468Z"}	—
   SSVC assessment	added	—	{"id":"CVE-2023-22894","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T17:40:11.255802Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 08.10.2026Record modifiedCISA ADP

   CVSS V3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

   CVSS V3.1: before AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, after —

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
   CVSS	removed	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	—
   SSVC assessment	removed	{"id":"CVE-2023-22894","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-06T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2023-22894","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-07T03:55:19.746468Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0