CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information
Authenticated attackers can exploit query filters to discover sensitive user details, including password hashes and reset tokens, via the admin panel.
- Exploited in the wild
- Since 8 Oct 2026
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22894?
CVE-2023-22894 is a high-severity vulnerability in n/a, published on 19 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
Weakness: CWE-312
Which versions are affected by CVE-2023-22894?
2 open source packages ship an affected version, including @strapi/strapi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@strapi/strapi npm | From 3.2.1 | 4.8.0 |
@strapi/strapi npm | From 3.2.1 | 4.8.0 |
Products include Strapi Strapi.
How do I fix CVE-2023-22894?
Upgrade @strapi/strapi to 4.8.0 or later. US federal agencies must fix it by 11 Oct 2026.
Is CVE-2023-22894 being exploited?
Yes. Attackers have exploited CVE-2023-22894 in the wild since at least 8 Oct 2026.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
- CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi
- CVE-2020-27664 Authorization bypass in Strapi
- CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token
- CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder
Sources
Also known as GHSA-jjqf-j4w7-92w8.