CVE-2023-22894: Strapi Information Disclosure
Active exploitation confirmed in CISA KEV.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NActive exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-08. Federal agencies must patch by 2026-10-11.
TL;DR - CVE-2023-22894 can expose sensitive Strapi user data through improperly handled query filters. - Strapi versions
>=3.2.1and<4.8.0are affected. Upgrade to Strapi 4.8.0 or later. - CISA lists the vulnerability in its Known Exploited Vulnerabilities catalog, making internet-facing instances urgent patching and investigation priorities.
CVE-2023-22894 is a Strapi vulnerability involving sensitive-information disclosure through query filtering. Depending on permissions, configuration, exposed relations, and API availability, an attacker may infer or retrieve private fields such as usernames, email addresses, password hashes, or password-reset tokens.
Strapi versions >=3.2.1 and <4.8.0 are affected. The minimum identified fixed version is Strapi 4.8.0, although organizations should prefer the latest supported release. CISA lists CVE-2023-22894 in its KEV catalog, so organizations should prioritize patching and forensic review.
For background on related security terminology, see our prompt injection glossary and active directory definition.
CVE-2023-22894 at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2023-22894 |
| Product | Strapi, npm package @strapi/strapi |
| CVSS | 4.9 Medium, CVSS 3.1 |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
| Attack vector | Network |
| Authentication / privileges | NVD rates it as requiring high privileges; vendor research describes unauthenticated exploitation in certain deployments |
| User interaction | None |
| Patch available | Yes |
| Affected versions | >=3.2.1, <4.8.0 |
| Fixed version | Strapi 4.8.0 |
| CISA KEV | Yes; added October 8, 2026 |
| Ransomware association | Unknown |
What Happened?
CVE-2023-22894 is an information-disclosure vulnerability caused by insufficient protection of private fields during query processing. Strapi filtering behavior may allow an attacker to reference fields that should not be exposed through normal application responses.
Differences in response content or behavior can reveal whether a sensitive value matches a chosen condition. Depending on the application’s design and authorization controls, potentially exposed information includes:
- Usernames and email addresses
- Password hashes
- Password-reset tokens
- API-user records
- Administrator-related information
- Other private fields exposed through affected relations
The NVD description focuses on attackers with access to the Strapi admin panel. It states that a super-admin may expose password hashes and reset tokens for all users, while a lower-privileged administrator may discover sensitive API-user information accessible through permitted fields.
Strapi’s security disclosure describes broader deployment scenarios, including unauthenticated access when exposed API functionality and application configuration make the behavior reachable. It also describes a possible chain with CVE-2023-22621 that may lead from information disclosure and account takeover to server-side template injection and remote code execution.
Analyst’s take: The NVD score understates the operational priority of internet-facing deployments because it does not account for KEV status or broader attack chains. Patch exposed systems first, then investigate whether query-filter abuse or follow-on activity occurred.
Who Is Affected?
Organizations running the Strapi package @strapi/strapi should inventory every deployment and confirm its exact version. The cited advisory range covers Strapi versions >=3.2.1 and <4.8.0, including Strapi 3.x and Strapi 4.x releases before 4.8.0.
| Product or version | Status | Required action |
|---|---|---|
Strapi <3.2.1 |
Not covered by the cited range | Verify independently with vendor documentation |
Strapi >=3.2.1 and <4.8.0 |
Affected | Upgrade or migrate immediately |
| Strapi 4.8.0 | Fixed version identified by the advisory | Upgrade at minimum; prefer the latest supported release |
| Strapi versions later than 4.8.0 | Not covered by this specific range | Maintain a supported release and monitor advisories |
| Strapi 3.x deployments | Unsupported branch and affected under the broad advisory range | Migrate to a supported Strapi release |
Prioritize:
- Internet-facing Strapi administration panels
- Public APIs with filtering or relational population enabled
- Applications containing administrator or API-user relations
- Systems storing reset tokens, credentials, API keys, or other secrets
- Deployments with weak authorization or broad API permissions
Strapi 3.x users should not assume that an upgrade within the 3.x branch is sufficient. Strapi 3.x is end of life; plan a migration to a supported Strapi release.
Root Cause and Potential Impact
The vulnerability is not a conventional memory-safety flaw. Its impact depends heavily on application design, including:
- Public API routes
- Enabled filtering and population features
- Content-type relations
- Authorization rules
- Whether administrator or API-user records are reachable
- Whether sensitive fields are included in queryable objects
An attacker may use response differences to determine whether a private field contains a selected value. In some configurations, this could expose password hashes or reset tokens. Those disclosures may enable account takeover or support further exploitation.
The potential consequences include:
- Enumeration of user or administrator information
- Disclosure of password hashes or reset tokens
- Account takeover through exposed credentials or tokens
- Chaining with CVE-2023-22621
- Potential server-side template injection and remote code execution
Exploitability is deployment-dependent. A public proof of concept does not prove that every Strapi instance is remotely exploitable without authentication. However, KEV status means vulnerable internet-facing systems should be treated as at risk.
Why Is the CVSS Score Medium?
The NVD rating is CVSS 3.1: 4.9 Medium:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
The vector means:
- AV:N — Network: The attack occurs over a network.
- AC:L — Low: No unusual technical conditions are required once access is available.
- PR:H — High: NVD assumes substantial privileges, such as admin-panel access.
- UI:N — None: No separate victim interaction is required.
- S:U — Unchanged: The impact remains within Strapi’s security authority.
- C:H — High: Sensitive information may be disclosed.
- I:N — None: The base scenario does not directly modify data.
- A:N — None: The base scenario does not directly affect availability.
The score is moderate because the NVD vector requires high privileges and assigns no direct integrity or availability impact. That does not mean every deployment presents low operational risk.
CISA assigned a supplemental score of 7.2 High using:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The higher rating reflects broader consequences that may result from credential exposure and chaining with another vulnerability. CVSS does not incorporate internet exposure, asset criticality, KEV status, or evidence of exploitation.
Has CVE-2023-22894 Been Exploited?
Yes. CISA lists CVE-2023-22894 in its Known Exploited Vulnerabilities catalog. The catalog entry was added on October 8, 2026, with a federal remediation due date of October 11, 2026.
The CISA record does not identify a ransomware campaign associated with this vulnerability. Its ransomware field is Unknown. Organizations should not claim a ransomware connection without evidence, but the absence of attribution does not make exploitation harmless.
Strapi’s security disclosure describes proof-of-concept activity and a reported chain involving CVE-2023-22621. Third-party research discusses a path from information disclosure to administrator account takeover and possible remote code execution in vulnerable configurations.
Investigators should look for:
- Unusual query-filter requests
- Enumeration of user or administrator records
- Suspicious administrator logins
- Password-reset activity
- Newly created administrator accounts
- API-key or application-secret changes
- Unexpected template or configuration changes
- Child processes spawned by the Strapi service
- Unexpected outbound connections from the application host
Verify the Upgrade
After deployment, verify both the package and runtime version:
npm ls @strapi/strapi --all
node -p "require('@strapi/strapi/package.json').version"
Confirm that the output is 4.8.0 or later. Then test representative API requests and verify that private fields are neither returned nor inferable through filtering.
Review logs for continued suspicious activity:
grep -Eai \
'(\\bfilters?\\b|\\bpopulate\\b|\\bwhere\\b).*(password|reset|token|admin|user)' \
/var/log/nginx/access.log
If the deployment remains on an affected version, document any exception with:
- A named risk owner
- An expiration date
- Network restrictions
- Monitoring coverage
- A committed migration date
Final Takeaway
Identify every internet-facing Strapi deployment in the affected range and upgrade it to Strapi 4.8.0 or later. Restrict exposure while upgrading, rotate credentials and tokens that may have been disclosed, and review logs for query-filter abuse, account takeover, or follow-on activity.
For organizations reviewing broader security tooling, compare requirements against these best SIEM platforms for small businesses. A SIEM can help centralize web, authentication, WAF, and process telemetry needed to investigate this vulnerability.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Start with an asset and dependency inventory. Identify every Strapi deployment, exact version, exposure path, authentication model, enabled API route, and content type that references administrator or API-user records.
Do not rely only on an application banner. Reverse proxies, containers, package lockfiles, and build processes may obscure the runtime version.
For source-controlled deployments:
npm ls @strapi/strapi --all
grep -n '"@strapi/strapi"' package.json package-lock.json yarn.lock 2>/dev/null
For containerized systems:
docker exec <container> npm ls @strapi/strapi --all
docker inspect --format '{{.Config.Image}}' <container>
Treat a vulnerable version as exposed until the organization confirms that affected functionality is unreachable and compensating controls are effective.
Web and SIEM Detection
Review reverse-proxy, web-server, WAF, and Strapi logs for requests containing nested query parameters that attempt to filter, populate, or traverse sensitive fields.
A generic web-log search might include:
zgrep -Eai \
'(\\bfilters?\\b|\\bpopulate\\b|\\bwhere\\b).*(password|passwordHash|reset|token|email|username|admin|user)' \
/var/log/nginx/access.log*
For SIEM systems, normalize URL-decoded query strings and alert when nested filtering or population syntax appears alongside sensitive field names. A conceptual Splunk query is:
index=web
| eval q=urldecode(query_string)
| search (q="*filter*" OR q="*populate*" OR q="*where*")
| regex q="(?i)(password|passwordHash|reset|token|email|username|admin|user)"
| stats count values(uri) values(src_ip) by user, status, http_method
This is a detection starting point, not a universal Strapi signature. Tune it against normal application traffic to reduce false positives.
Prioritize requests with:
- Repeated Boolean-style probes
- Unusual nested query structures
- Sensitive field names
- High-volume enumeration
- Unexpected access to user-related endpoints
- Large or unusual response sizes
- Unauthenticated access to normally restricted data
Investigate suspicious server-side template activity and unexpected outbound connections because CVE-2023-22894 may be chained with CVE-2023-22621.
Remediation and Patching
Upgrade affected installations to Strapi 4.8.0 or later, preferably to the latest supported release. The minimum fixed version is not necessarily the best operational target because later releases may include additional security fixes and compatibility improvements.
For a supported npm-based Strapi 4 project:
npm install @strapi/strapi@^4.8.0
npm install
npm audit
npm run build
For Yarn:
yarn add @strapi/strapi@^4.8.0
yarn install
yarn build
Do not apply these commands blindly to production. Before deployment:
- Back up the database and uploads.
- Review Strapi’s documented upgrade requirements.
- Test custom plugins and content types.
- Rebuild the application.
- Deploy through the normal change process.
- Confirm the running process uses the intended version.
- Test representative API requests.
- Verify that private fields cannot be returned or inferred through filtering.
Strapi 3.x users should plan a supported migration rather than remaining on the unsupported branch.
Temporary Exposure Reduction
Until patching is complete:
- Remove unnecessary public access to Strapi administration and API endpoints.
- Restrict administrative access through a VPN, identity-aware proxy, or allowlist.
- Disable unnecessary public filtering and relational population.
- Remove relations exposing administrator or API-user records unless required.
- Enforce least privilege for admin-panel and API users.
- Add WAF or reverse-proxy rules for suspicious nested filters.
- Monitor and rate-limit user-record enumeration.
- Isolate vulnerable systems from the internet where feasible.
These measures are temporary controls, not substitutes for upgrading.
Credential and Token Rotation
If password hashes, reset tokens, API keys, or application secrets may have been exposed:
- Rotate administrator and API-user passwords.
- Invalidate password-reset tokens.
- Rotate API keys and application secrets.
- Preserve authentication and reset logs before rotation.
- Review login activity for suspicious access.
- Investigate indicators of compromise before rebuilding or destroying systems.
If compromise indicators exist, isolate the host, preserve relevant disk or container evidence, and investigate possible exploitation of CVE-2023-22621.
Organizations governed by CISA KEV remediation requirements should follow applicable deadlines and forensic-triage procedures. KEV status warrants emergency change handling rather than waiting for a routine maintenance window.
References
-
NVD: CVE-2023-22894
NVD description, CVSS vector, affected-version summary, and CWE information. -
CISA Known Exploited Vulnerabilities Catalog
Lists CVE-2023-22894 as exploited in the wild and records its addition date, federal due date, and unknown ransomware association. -
Strapi security disclosure
Affected range, fixed version, disclosure details, proof-of-concept context, and chaining discussion. -
Strapi GitHub releases
Release information for validating available versions and upgrade targets. -
GitHub Advisory Database: GHSA-jjqf-j4w7-92w8
Affected npm package, version range, patched version, and information-disclosure impact. -
Technical research on multiple Strapi vulnerabilities
Research on the reported chain involving CVE-2023-22894 and CVE-2023-22621.