Strapi CVE-2023-22894: sensitive data leaked via query filter

On 8 October 2026 CISA added CVE-2023-22894 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Strapi, the headless CMS used as a content backend for websites and applications. Anyone with access to the admin panel can abuse the query filter to infer sensitive information about users. With a super admin account, this reaches the password hash and the password reset token of every user.

The vulnerability was published in April 2023. Its entry in the KEV catalogue means CISA has evidence of active exploitation: organisations still running unpatched Strapi instances should treat it as a priority.

What happened

CISA listed CVE-2023-22894 in the KEV catalogue as “Strapi Cleartext Storage of Sensitive Information Vulnerability” and set 11 October 2026 as the deadline for US federal agencies: three days. The catalogue marks its use in ransomware campaigns as “unknown”.

The advisory asks organisations to apply mitigations according to the vendor’s instructions, in line with Binding Operational Directive BOD 26-04 on prioritising updates based on risk and with CISA’s forensic triage requirements. For cloud services the same directive applies; if no mitigations are available, the product should be discontinued. The advisory also asks organisations to assess the internet exposure of every asset.

CISA gives no details about the attacks observed, the attackers or the victims.

Technical details

• CVE: CVE-2023-22894, published on 19 April 2023. The NVD entry was updated on 9 October 2026 and is still undergoing analysis.
• Mechanism: from the admin panel, the attacker can filter users by columns that contain sensitive information and infer their value from the API responses. The data is not read directly: it is deduced by observing which filters return results.
• With a super admin account: the attacker obtains the password hash and password reset token of all users.
• With a lower-privileged account (for example with the Editor or Author role) that is allowed to see the username and email of API users: the attacker obtains sensitive information on all API users, but not on other admin accounts.
• Prerequisite: access to the admin panel is required. An anonymous user cannot exploit this vulnerability.
• Affected versions: the NVD entry is not consistent here. The description refers to Strapi through 4.5.5; the product configuration (CPE) lists versions from 3.2.1 up to, but not including, 4.8.0. Strapi’s security advisory, listed among the entry’s references, is the authority on which version contains the fix.
• Severity: the scores diverge too. NIST assigns CVSS 3.1 4.9 (medium), AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, with an impact on confidentiality only. Another score recorded in the entry is 7.2 (high), AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Both require high privileges.
• Weakness: CWE-312 (cleartext storage of sensitive information).
• Public code: among the NVD references, both Strapi’s advisory and a third-party analysis are tagged “Exploit”, so the details needed to exploit the flaw are public.

Impact for European and Italian organisations

Strapi often manages the content and users of websites, portals and applications. API users may be the customers or subscribers of a service: usernames, emails, password hashes and tokens are personal data and credentials. Their theft may amount to a personal data breach under the GDPR, to be assessed for notification to the supervisory authority (in Italy, the Garante) within 72 hours.

Needing admin panel access does not make the risk negligible. An admin account with a weak password or one already exposed in a breach, or a contributor with a limited role, is enough to reach data they should not see. Password reset tokens exist to change an account’s password: they must be protected like the passwords themselves.

For NIS2 entities, this vulnerability falls under vulnerability management and supply chain security: many Strapi sites are built and run by external agencies, which need to be involved in the checks. A significant incident must be reported to the national CSIRT, which in Italy is CSIRT Italia at the ACN.

What to do now

1. Take inventory: identify every Strapi installation, including those run by suppliers and agencies, and the version of each.
2. Update: move every installation out of the version range given in the NVD entry, checking the fixed version in Strapi’s advisory. Installations on the 3.x branch should be reviewed with the vendor.
3. Restrict access to the admin panel: where possible, it should not be reachable from the whole internet.
4. Review accounts and roles: remove unused admin accounts, check who holds the super admin role and who can see API users’ data.
5. If you suspect abuse: change admin passwords, invalidate pending reset tokens and consider asking users to change their passwords.
6. Detect: search server and reverse proxy logs for unusual admin panel requests that filter users on sensitive fields, such as the password hash or reset token, and for admin panel logins from unknown addresses.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package and highlights those already exploited by attackers, such as the CVEs in the KEV catalogue. ARX Expose checks the services your company exposes on the internet, the products it recognises and their known vulnerabilities, and flags company accounts involved in breaches. ARX Sentry collects logs and events from servers, so anomalous access stays visible.

Last updated: 8 October 2026