Improper Access Control

@strapi/core is vulnerable to improper access control. The vulnerability is due to improper sanitization of query parameters in the document service lookup operator, which allows an attacker to craft malicious queries to access private fields such as admin passwords and reset tokens...

PT-2025-42484

Name of the Vulnerable Software and Affected Versions Strapi versions 5.0.0 through 5.5.1 Description Strapi is an open-source headless content management system. A flaw in the document service lookup does not properly sanitize query parameters for private fields. This allows an attacker to acces...