CVE-2023-22894: Strapi private-field filtering leaks password hashes and reset tokens
Exploited in the wild Medium 4.9 EPSS 4.1%
Strapi 3.2.1 up to (not including) 4.8.0 lets API query filters reference private user columns, so an attacker can infer emails, password hashes and password reset tokens from API responses; Strapi also disclosed a method to exploit it without authentication to hijack admin accounts. Strapi 3.x is end of life and gets no fix; upgrade to 4.8.0 or later. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-08.
- CVE-2023-22894CVE identifier
- 4.9CVSS 3.1 base score (medium)
- 2026-10-08added to CISA's exploited list (US federal deadline 2026-10-11)
- 4.1%EPSS: chance of exploitation in the next 30 days (higher than 91% of CVEs)
- 2023-04-19published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run the affected software and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Restart the affected service (or reboot for kernel and library updates) so the fix is actually in use.
- Because this flaw is being exploited, also check the server for signs of compromise.
Affected and fixed versions
Affected:
- Strapi >= 3.2.1, < 4.8.0 (all 3.x releases are unpatched)
Fixed in:
- Strapi 4.8.0
Am I affected?
npm ls @strapi/strapiLook for signs of exploitation
- Strapi's published IoC: search request logs for filters on private fields, e.g. grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)' /path/to/access.log Many matches with password, reset_password_token or resetPasswordToken mean hashes and reset tokens were likely leaked: start incident response.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve ; https://github.com/strapi/strapi/releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/
Related vulnerabilities
Sources
- Strapi: Security disclosure of vulnerabilities CVE-2023-22893, CVE-2023-22621, CVE-2023-22894
- CVE record CVE-2023-22894
- https://github.com/strapi/strapi/releases
- https://www.ghostccamm.com/blog/multi_strapi_vulns/
- CVE-2023-22894 on CVE.org
- CVE-2023-22894 on NVD
- CISA Known Exploited Vulnerabilities catalog
Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.