Key points
- CISA added CVE-2023-22894 to the Known Exploited Vulnerabilities catalog on October 8, 2026.
- The flaw allows attackers with admin panel access to extract sensitive user details via query filters.
- This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
The short version
- Strapi contains a vulnerability that permits the cleartext storage and exposure of sensitive information.
- Attackers need access to the admin panel to exploit this flaw and discover user details.
- CISA requires mitigation by October 11, 2026, per its Known Exploited Vulnerabilities catalog entry.
The details
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-22894 to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026. The entry mandates that stakeholders apply mitigations by October 11, 2026. According to the CISA description, this vulnerability involves the cleartext storage of sensitive information within Strapi. It allows attackers who have gained access to the admin panel to discover sensitive user details by exploiting the query filter feature.
The National Vulnerability Database (NVD) rates this vulnerability as Medium severity with a CVSS score of 4.9. The flaw affects Strapi versions through 4.5.5. An attacker with admin panel access can filter users by columns containing sensitive information and infer values from API responses. If the attacker holds super admin access, they can exploit this to discover password hashes and password reset tokens for all users. Even with lower-privileged roles, such as Editor or Author, an attacker with admin panel access can discover sensitive information for all API users, though not for other admin accounts.
The context
This vulnerability is significant because it can be chained with another flaw, CVE-2023-22621, to achieve remote code execution. CISA notes that impacted products could be end-of-life (EoL) or end-of-service (EoS). Users are advised to discontinue use of affected versions and transition to supported releases.
The required action includes applying mitigations in accordance with vendor instructions and ensuring compliance with CISA’s Binding Operational Directive 26-04 on prioritizing security updates. Stakeholders must evaluate each asset's internet exposure and adhere to patching guidelines. For cloud services, applicable BOD 26-04 guidance should be followed, or use of the product should be discontinued if mitigations are unavailable.
What should you do?
Organizations using Strapi should immediately audit their installations to determine if they are running versions through 4.5.5. Administrators should review admin panel access logs for suspicious query filter activity. If the product is end-of-life, plan a migration to a supported version. Monitor for any vendor instructions regarding specific mitigations for this cleartext storage issue.
What to do and how to stay safe: Strapi
- Inventory all Strapi instances to identify versions through 4.5.5.
- Restrict admin panel access to trusted networks and personnel.
- Monitor API responses for unexpected data exposure via query filters.
- Prepare to migrate from end-of-life versions to supported releases.
Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the deadline to fix CVE-2023-22894?
CISA requires mitigation by October 11, 2026.
Can this vulnerability lead to remote code execution?
Yes, it can be chained with CVE-2023-22621 to achieve remote code execution.
Who can exploit this vulnerability?
Attackers with access to the Strapi admin panel can exploit this flaw.
