@abip/scp-common (=1.0.1-alpha.0), @akemona-org/strapi-admin (>=3.7.0 <=3.19.3) +402 more potentially affected by CVE-2026-1774 via @casl/ability (>=2.4.2 <=6.7.3)

@casl/ability NPM version =2.4.2, =3.7.0, =0.2.0, =0.3.1, =4.25.19-patch.1, =0.0.1, =0.0.1, =0.1.0, =1.7.0, =0.7.1, =0.13.85 and more Source cves: CVE-2026-1774 Source advisory: SNYK:JS-CASLABILITY-15268419...

CVE-2021-28128

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...

CVE-2022-31367

Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses...

CVE-2019-18818

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js...

CVE-2024-34065

Strapi is an open-source content management system. By combining two vulnerabilities an Open Redirect and session token sent as URL query parameter in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and...

CVE-2022-27263

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file...

Improper Password Length Validation

@strapi/core is vulnerable to improper password length validation. The vulnerability is due to the lack of enforcing a maximum password length when using bcryptjs, which truncates passwords beyond 72 bytes, allowing an attacker to authenticate using only the first 72 bytes of an overlong password...

Cross-Origin Resource Sharing (CORS) Misconfiguration

@strapi/core is vulnerable to Cross-Origin Resource Sharing CORS Misconfiguration. The vulnerability is due to improper validation of the Origin header in default configurations, which allows an attacker to exploit this by hosting a malicious site on a different origin and sending credentialed...

CVE-2025-3930

Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...

CVE-2024-56143

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset...

CVE-2025-53092

Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper...

CVE-2025-25298

Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account...

EUVD-2025-34775

Strapi core vulnerable to sensitive data exposure via CORS misconfiguration...

@avorati/strapi-plugin-preview (=1.0.1), @futurebrand/helpers-strapi (>=2.0.2 <=2.5.4) +8 more potentially affected by CVE-2025-53092 via @strapi/core (>=0.0.0-experimental.a13c58eec89ab119f0e381fb79c0252979e9c125 <=5.1.1)

@strapi/core NPM version =0.0.0-experimental.a13c58eec89ab119f0e381fb79c0252979e9c125, =2.0.2, =0.0.1, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4, =5.19.0 - custom-strapi-plugin-socket =1.0.2 - stronges =0.1.1 - test-lead =0.1.0 Source cves: CVE-2025-53092 Source advisory:...

GHSA-9329-MXXW-QWF8 Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Summary A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses. Technical Details By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header...

Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Summary A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses. Technical Details By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header...

EUVD-2025-34776

Strapi Password Hashing Missing Maximum Password Length Validation...

@jhoward1994/strapi-plugin-ckeditor (>=0.0.1 <=0.0.1-rc5), @strapi/admin (=0.0.0-experimental.6dbac0c205b0f8495781db5706c18cac1a62e62b) +3 more potentially affected by CVE-2025-25298 via @strapi/core (>=0.0.0-experimental.a13c58eec89ab119f0e381fb79c0252979e9c125 <=5.10.2)

@strapi/core NPM version =0.0.0-experimental.a13c58eec89ab119f0e381fb79c0252979e9c125, =0.0.1, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4, =5.10.2 - custom-strapi-plugin-socket =1.0.2 Source cves: CVE-2025-25298 Source advisory: OSV:GHSA-2CJV-6WG9-F4F3...

GHSA-2CJV-6WG9-F4F3 Strapi Password Hashing is Missing Maximum Password Length Validation

Summary Strapi's password hashing implementation using bcryptjs lacks maximum password length validation. Since bcryptjs truncates passwords exceeding 72 bytes, this creates potential vulnerabilities such as authentication bypass and performance degradation. POC Create an admin user with a passwo...

@avorati/strapi-plugin-preview (=1.0.1), @catchmexz/fedin-cms (>=5.30.1 <=5.30.2) +26 more potentially affected by CVE-2024-56143 via @strapi/core (>=5.0.0 <=5.5.1)

@strapi/core NPM version =5.0.0, =5.30.1, =1.0.0, =2.3.1, =2.0.2, =0.1.0, =2.0.0, =1.0.1, =5.0.0, =0.1.0, =0.2.0, =0.5.0 - cypherscan-strapi =0.1.1 - keycloak-auth-plugin =0.0.1 - my-shopify-app-backend =0.1.0 and more Source cves: CVE-2024-56143 Source advisory: OSV:GHSA-495J-H493-42Q2...