CVE-2026-57997 | Medium | 4.8 | 2026-06-29 | Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance… |
CVE-2026-27886 | High | 7.5 | 2026-05-14 | Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query paramete… |
CVE-2026-22707 | Medium | 5.4 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the… |
CVE-2026-22706 | Medium | 6.5 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the… |
CVE-2026-22599 | High | 7.2 | 2026-05-14 | Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-qu… |
CVE-2025-64526 | Medium | 5.3 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin deri… |
CVE-2025-53092 | Medium | 6.5 | 2025-10-16 | Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installat… |
CVE-2025-25298 | Medium | 5.3 | 2025-10-16 | Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for passwo… |
CVE-2024-56143 | High | 8.2 | 2025-10-16 | Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does… |
CVE-2025-3930 | | | 2025-10-16 | Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen… |
CVE-2024-52588 | Medium | 4.9 | 2025-05-29 | Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetc… |
CVE-2024-37818 | High | 8.6 | 2024-06-20 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to… |
CVE-2024-34065 | High | 7.1 | 2024-06-12 | Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @s… |
CVE-2024-31217 | Medium | 5.3 | 2024-06-12 | Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing t… |
CVE-2024-29181 | Low | 2.3 | 2024-06-12 | Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an assoc… |
CVE-2023-48218 | Medium | 5.3 | 2023-11-20 | The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field… |
CVE-2023-39345 | High | 7.6 | 2023-11-06 | strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration en… |
CVE-2023-38507 | High | 7.3 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen… |
CVE-2023-37263 | Medium | 6.8 | 2023-09-15 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title… |
CVE-2023-36472 | Medium | 5.8 | 2023-09-15 | Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if the… |
CVE-2023-34235 | High | 8.6 | 2023-07-25 | Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` pre… |
CVE-2023-34093 | Medium | 4.8 | 2023-07-25 | Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a… |
CVE-2023-22894 | Medium | 4.9 | 2023-04-19 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filt… |
CVE-2023-22893 | High | 7.5 | 2023-04-19 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A rem… |
CVE-2023-22621 | High | 7.2 | 2023-04-19 | Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacke… |
CVE-2022-31367 | High | 8.8 | 2022-09-27 | Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. |
CVE-2022-32114 | High | 8.8 | 2022-07-13 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE… |
CVE-2022-29894 | Medium | 4.8 | 2022-06-13 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary… |
CVE-2022-30618 | High | 7.5 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if cont… |
CVE-2022-30617 | High | 8.8 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel… |
CVE-2021-46440 | High | 7.5 | 2022-05-03 | Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a vict… |
CVE-2022-27263 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-0764 | Medium | 6.7 | 2022-02-26 | Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0. |
CVE-2021-28128 | High | 8.1 | 2021-05-06 | In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a val… |
CVE-2020-27666 | Medium | 5.4 | 2020-10-22 | Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature. |
CVE-2020-27665 | High | 7.5 | 2020-10-22 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes. |
CVE-2020-27664 | Critical | 9.8 | 2020-10-22 | admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality. |
CVE-2020-13961 | Medium | 6.5 | 2020-06-19 | Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any s… |
CVE-2020-8123 | Medium | 4.9 | 2020-02-04 | A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of t… |
CVE-2019-19609 | High | 7.2 | 2019-12-05 | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because i… |
CVE-2019-18818 | Critical | 9.8 | 2019-11-07 | strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controll… |