Strapi vulnerabilities
29 CVEs and advisories name Strapi as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118171CVE-2026-118171
- CVE-2026-118172CVE-2026-118172
- CVE-2026-118170CVE-2026-118170
- CVE-2026-108114Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
- CVE-2026-90561Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
- CVE-2026-57997Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration
- CVE-2026-27886Strapi may leak sensitive data via relational filtering due to lack of query sanitization
- CVE-2026-22707Strapi Upload Plugin MIME Validation Bypass via Content API
- CVE-2026-22706Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
- CVE-2026-22599Strapi Vulnerable to SQL Injection in Content Type Builder
- CVE-2025-64526Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
- CVE-2025-53092Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
- CVE-2025-25298Missing Maximum Password Length Validation in Strapi Password Hashing
- CVE-2024-56143Strapi Allows Unauthorized Access to Private Fields via parms.lookup
- CVE-2025-3930Lack of JWT Expiration after Log Out in Strapi
- CVE-2024-52588Strapi allows Server-Side Request Forgery in Webhook function
- CVE-2024-34065@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
- CVE-2024-31217@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling
- CVE-2024-29181@strapi/plugin-content-manager leaks data via relations via the Admin Panel
- CVE-2023-39345Unauthorized Access to Private Fields in User Registration API in strapi
- CVE-2023-38507Strapi Improper Rate Limiting vulnerability
- CVE-2023-37263Strapi's field level permissions not being respected in relationship title
- CVE-2023-36472Strapi may leak sensitive user information, user reset password, tokens via content-manager views
- CVE-2023-34235Leaking sensitive user information still possible by filtering on private with prefix fields
- CVE-2023-34093Strapi allows actors to make all attributes on a content-type public without noticing it
- CVE-2022-29894Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function.
- CVE-2022-30618An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, fo
- CVE-2022-30617An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, fo
- CVE-2022-0764Arbitrary Command Injection in strapi/strapi