CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability

According to CISA's catalog, Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter.[2] CISA says the flaw can be chained with CVE-2023-22621 to achieve remote code execution.[2]CVE Security reports that CISA listed this CVE in the Known Exploited Vulnerabilities catalog on Oct. 8, 2026, with a federal remediation deadline of Oct. 11, 2026.[3] The Hacker News says that federal agencies must apply the necessary patches or discontinue their use by October 11, 2026.[1]The NVD-sourced description quoted by OpenCVE says that if the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users.[4] It says Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users.[5]Strapi's 2023 disclosure said that combining CVE-2023-22621 and CVE-2023-22894 would allow for an unauthenticated RCE on all Strapi <=4.5.5 servers.[6] The company told users to "Immediately update your Strapi to version >4.8.0!"[7] The Hacker News reports a CVSS score: 7.2[1], while Strix says it is rated 4.9/10 on the CVSS scale.[8]Strapi says exploitation of CVE-2023-22894 is easily detectable, since the payload is within the GET parameters[6] and those parameters normally appear in request logs.