Strapi - vulnerabilities (CVEs)

46 CVEs in 8 products, 4 in the last 30 days, newest from 2026-10-27.

Products

Strapi - 40 CVEs
Strapi Open Source And Enterprise Headless Cms - 3 CVEs
Strapiplugin-users-permissions - 2 CVEs
Protected Populate - 1 CVEs
Strapiadmin - 1 CVEs
Strapicontent-type-builder - 1 CVEs
Strapistrapi - 1 CVEs
Strapiupload - 1 CVEs

Newest CVEs of Strapi

CVE-2026-118171, 2026-10-27: The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to…
CVE-2026-118172, 2026-10-27: The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically…
CVE-2026-118170, 2026-10-27: The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller…
CVE-2026-108114 - CVSS 5.3 (medium), 2026-10-10: Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after…
CVE-2026-90561 - CVSS 9.3 (critical), 2026-09-13: Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component…
CVE-2026-57997 - CVSS 6.3 (medium), 2026-06-29: Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing…
CVE-2026-27886 - CVSS 9.2 (critical), 2026-05-14: Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query…
CVE-2026-22707 - CVSS 5.4 (medium), 2026-05-14: Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the…
CVE-2026-22706 - CVSS 6.5 (medium), 2026-05-14: Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate…
CVE-2025-64526 - CVSS 6.9 (medium), 2026-05-14: Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin…
CVE-2026-22599 - CVSS 9.3 (critical), 2026-05-14: Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a…
CVE-2025-53092 - CVSS 6.5 (medium), 2025-10-16: Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default…
CVE-2025-25298 - CVSS 6.3 (medium), 2025-10-16: Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for…
CVE-2024-56143 - CVSS 8.2 (high), 2025-10-16: Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does…
CVE-2025-3930 - CVSS 6.3 (medium), 2025-10-16: Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has…
CVE-2024-52588 - CVSS 7.5 (high), 2025-05-29: Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application…
CVE-2024-37818 - CVSS 8.6 (high), 2024-06-20: Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to…
CVE-2024-34065 - CVSS 8.1 (high), 2024-06-12: Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in…
CVE-2024-31217 - CVSS 6.5 (medium), 2024-06-12: Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing…
CVE-2024-29181 - CVSS 3.5 (low), 2024-06-12: Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an…
CVE-2023-48218 - CVSS 5.3 (medium), 2023-11-20: The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field…
CVE-2023-39345 - CVSS 7.6 (high), 2023-11-06: strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration…
CVE-2023-38507 - CVSS 9.8 (critical), 2023-09-15: Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin…
CVE-2023-36472 - CVSS 5.8 (medium), 2023-09-15: Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if…
CVE-2023-37263 - CVSS 6.8 (medium), 2023-09-15: Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title.…
CVE-2023-34235 - CVSS 8.6 (high), 2023-07-25: Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)`…
CVE-2023-34093 - CVSS 7.1 (high), 2023-07-25: Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a…
CVE-2023-22893 - CVSS 8.2 (high), 2023-04-19: Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A…
CVE-2023-22621 - CVSS 10 (critical), 2023-04-19: Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote…
CVE-2023-22894 - CVSS 7.2 (high), 2023-04-19: Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can…