Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@strapi/plugin-users-permissions

7 known vulnerabilities (1 critical, 4 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 critical, 4 high, 1 medium, 1 low
Weekly downloads
308.5K
Dependents
0
Registry
npm

Advisories 7

  • Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

    Affected: fixed in 5.33.3.

  • CVE-2025-64526Medium 6.9

    Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

    Affected: fixed in 5.45.0.

  • @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass

    Affected: fixed in 4.24.2.

  • Unauthorized Access to Private Fields in User Registration API in strapi

    Affected: from 4.0.0, fixed in 4.13.1.

  • Strapi Improper Rate Limiting vulnerability

    Affected: fixed in 4.12.1.

  • Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for…

    Affected: from 3.2.1, fixed in 4.6.0.

  • CVE-2023-22621Critical 10.0

    Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the…

    Affected: fixed in 4.5.6.