CVE-2023-36472

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The "/content-manager/relations" route does not remove private fields or ensure that they can't be...

PT-2023-25582

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.11.7 Description The issue allows an unauthorized actor to access user reset password tokens if they have configure view permissions. The /content-manager/relations route does not remove private fields or ensure that...