Strapi CMS flaw CVE-2023-22894 added to CISA's exploited list; fixed in 4.8.0
CISA says attackers are using a 2023 Strapi flaw (CVE-2023-22894) that leaks user password hashes and reset tokens, and that can be chained to run code. Fixed in Strapi 4.8.0. If you run Strapi, update to the latest v4 and move off v3.
If you run Strapi, update to version 4.8.0 or later (ideally the latest v4 release) and move off end-of-life v3. Reset admin and user passwords and tokens if the site was exposed on an older version, or ask whoever manages your website.
What’s happening
CISA added CVE-2023-22894 in the Strapi content management system to its list of flaws being used in attacks on 8 October 2026. The flaw is in how Strapi filters private fields: an attacker can use query parameters to read fields such as email addresses, password hashes and password reset tokens. Strapi disclosed it in April 2023. It affects versions from 3.2.1 up to but not including 4.8.0, and the fix shipped in 4.8.0 on 15 March 2023. Strapi says it can be chained with a second flaw, CVE-2023-22621, to take over a super admin account and then run code on the server. That second flaw is fixed in 4.5.6. CISA describes the access needed as admin panel access and rates it 4.9 through NVD, but Strapi says unauthenticated users could exploit it and rated it Critical. CISA also notes affected versions may be end-of-life. Details of the attacks, who is behind them and how many servers are affected have not been published in the sources read. This mainly affects businesses and developers running their own Strapi sites.
- What
- Flaw
- Affects
- Strapi headless CMS (v3 and v4 before 4.8.0)
- Affected
- Strapi >=3.2.1 and <4.8.0
- Fixed in
- 4.8.0
- Since
- 8 Oct 2026
- Closed
- 8 Oct 2026
Timeline
- CISA added
CISA added CVE-2023-22894 to its list of flaws being used in attacks, noting that affected versions may be end-of-life and can be chained with CVE-2023-22621 for code execution. A tracker reports a federal fix deadline of 2026-10-11.
- Update
Strapi published full details. It said chaining the two flaws let an attacker hijack a super admin account and then run code on servers running Strapi 4.5.5 or earlier.
- New fixFixed
Strapi released version 4.8.0, which fixes CVE-2023-22894. The related remote code execution flaw CVE-2023-22621 had been fixed earlier, in 4.5.6 on 2023-01-11.
- Made publicNo fix yet
A researcher reported the private-field filtering flaw to Strapi, first rated Medium. On 2023-01-18 it was raised to Critical after the researcher showed unauthenticated users could exploit it.
Sources
- Security disclosure of vulnerabilities CVE-2023-22621 and CVE-2023-22894Strapi · 17 Apr 2023
- CVE-2023-22894 detailNIST NVD · 8 Oct 2026