CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability

7IT reports that on Thursday 8 October 2026, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog, with a federal deadline of Sunday 11 October.[2] The outlet says they hit Strapi (CVE-2023-22894), ONLYOFFICE Docs (CVE-2021-3199), Apache Struts (CVE-2016-3081), ISC BIND (CVE-2015-5477) and ProFTPD (CVE-2015-3306).[2]CISA's catalog entry says the Strapi flaw "could allow attackers with access to the admin panel to discover sensitive user details via the query filter."[3] CISA also says this vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.[3]The Hacker News lists the flaw with a CVSS score of 7.2[1]. According to the security firm Innovation Network Design, the KEV additions came after a seven-nation advisory tied the attacks to Flax Typhoon and Beijing contractor Integrity Technology Group.[4]Strapi's own 2023 disclosure says a researcher "discovered a method to exploit this vulnerability as an unauthenticated user on all Strapi servers."[5] The GitHub advisory says an attacker could use the flaw to hijack Strapi administrator accounts and gain unauthorized Strapi Super Administrator access by leaking the password reset token[6].Strapi's disclosure tells users to "Immediately update your Strapi to version >4.8.0!"[5] It adds that the exploitation of CVE-2023–22894 is easily detectable, since the payload is within the GET parameters[5].Innovation Network Design advises that Strapi users should be on 4.8.0 or later, and since the flaw exposes password hashes and reset tokens, rotate admin credentials after upgrading.[4]