UpHeron
All vulnerabilities

Servers and applications

CVE-2023-22894

Leaking sensitive user information by filtering on private fields

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 8 Oct 2026.

Severity
Medium 4.9
Published
18 Apr 2023
Last changed
9 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.8.0
Also known as
GHSA-jjqf-j4w7-92w8
Sources
NVD, Project advisories (GitHub)

Description

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the…

Affected software

SoftwareAffected versions
StrapiServers and applications · cpe:a:strapi:strapi
  • From 3.2.1 before 4.8.0
StrapiServers and applications · github:strapi/strapi
  • From 3.2.1 before 4.8.0

Known exploited

CISA name
Strapi Cleartext Storage of Sensitive Information Vulnerability
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Due for US agencies
11 Oct 2026
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-22894
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-22894
  • GitHub Advisory Database https://github.com/advisories/GHSA-jjqf-j4w7-92w8
  • github.com https://github.com/strapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8