CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability

According to CVE Security, CISA listed this CVE in the Known Exploited Vulnerabilities catalog on Oct. 8, 2026[1]. The tracker says "Only CISA confirms exploitation."[1]CISA's catalog entry says Strapi "could allow attackers with access to the admin panel to discover sensitive user details via the query filter."[2] CISA adds that the flaw "can be chained with CVE-2023-22621 to achieve remote code execution."[2]The National Vulnerability Database (NVD) record, as shown on OpenCVE, states that if the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users.[3] CVE Security says the flaw carries a CVSS score of 4.9 MEDIUM[1]. It says an unauthenticated attacker can exploit this vulnerability to hijack Strapi administrator accounts[4], and that this can be exploited on all Strapi versions <=4.7.1.[4]In its own disclosure, Strapi said a researcher showed the two CVEs together allow for an unauthenticated RCE on all Strapi <=4.5.5 servers[5]. Strapi said it released version 4.8.0 that patches this vulnerability[6], and it urged users of 3.x and older to "IMMEDIATELY UPDATE TO A PATCHED 4.x.x VERSION!"[6]Strapi also said that exploitation is easily detectable, since the payload is within the GET parameters and are normally included in request logs.[5]CISA warns that the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS).[2]