CISA Adds Strapi Admin Data Leak to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) added a data exposure vulnerability in Strapi to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026. The entry for CVE-2023-22894 carries a federal due date of October 11, 2026, for mitigation.

According to the CISA record, this vulnerability allows attackers with access to the Strapi admin panel to discover sensitive user details by exploiting the query filter. The agency notes that the impacted products could be end-of-life (EoL) or end-of-service (EoS). CISA advises users to discontinue use or transition to a supported version. The entry also states that this vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

Technical Details and Risk Profile

The National Vulnerability Database (NVD) rates CVE-2023-22894 as a medium severity issue with a CVSS score of 4.9. The weakness is associated with CWE-312 (Cleartext Storage of Sensitive Information). According to the NVD record, the flaw affects Strapi versions through 4.5.5.

The vulnerability works by allowing an attacker with admin panel access to filter users by columns containing sensitive information. The attacker can then infer values from the API responses. The NVD specifies that if the attacker has super admin access, they can exploit this to discover the password hash and password reset token for all users.

If the attacker has access to an account with permissions to view the username and email of API users with lower privileged roles, such as Editor or Author, they can exploit the flaw to discover sensitive information for all API users. However, the NVD notes that in this specific scenario, the attacker cannot discover information for other admin accounts.

Who Is Affected

The primary impact falls on organizations using Strapi versions up to and including 4.5.5 that have exposed admin panels. The risk escalates significantly if the admin panel is accessible to threat actors, either through brute force, credential theft, or other initial access vectors.

The CISA KEV entry highlights that some affected products may be end-of-life or end-of-service. This status complicates remediation, as vendors may no longer provide security updates for these versions. The potential for chaining this data leak with CVE-2023-22621 to achieve remote code execution significantly increases the threat landscape for affected systems.

What should you do?

CISA requires stakeholders to apply mitigations in accordance with vendor instructions. Users must ensure compliance with CISA’s Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on risk. The agency also references its “Forensics Triage Requirements” in the notes for this entry.

For cloud services, organizations should follow applicable BOD 26-04 guidance. If mitigations are unavailable, CISA advises discontinuing use of the product. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to patching guidelines. As the source material does not confirm a specific software patch or version fix for this vulnerability, users should verify vendor guidance for supported versions.