Summary
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
- Vendor
- Strapi
- Product
- Strapi
- Added to KEV
- Oct 8, 2026
- Remediation due
- Oct 11, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-312
- EPSS
- 4.1% as of Nov 10
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References