Key points
- CISA added CVE-2023-22894 to the Known Exploited Vulnerabilities catalog on October 8, 2026.
- The flaw allows attackers with admin access to leak sensitive user data via query filters.
- This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
The Cybersecurity and Infrastructure Security Agency (CISA) has added a data leakage flaw in Strapi’s admin panel to its Known Exploited Vulnerabilities (KEV) catalog, setting a federal compliance deadline of October 11, 2026. This action signals that the vulnerability, tracked as CVE-2023-22894, is being actively exploited in the wild and poses an immediate risk to organizations using the headless content management system.
Developers and security teams must prioritize mitigating this issue to prevent credential theft and potential remote code execution. According to CISA, the flaw allows attackers who have gained access to the Strapi admin panel to discover sensitive user details by manipulating the query filter. While the initial impact is data exposure, the agency warns that this vulnerability can be chained with CVE-2023-22621 to achieve full remote code execution on the host server.
What we know
The National Vulnerability Database rates CVE-2023-22894 as Medium severity with a CVSS score of 4.9. The vulnerability affects Strapi versions through 4.5.5. It stems from cleartext storage of sensitive information and improper access controls within the admin interface.
Attackers with admin panel access can filter users by columns containing sensitive information and infer values from API responses. If an attacker holds super admin privileges, they can exploit this flaw to discover password hashes and password reset tokens for all users. For attackers with lower-privileged roles, such as Editor or Author, the flaw still allows them to discover sensitive information for all API users, though they cannot access other admin accounts.
CISA notes that some impacted product versions may be end-of-life (EoL) or end-of-service (EoS). In such cases, the agency advises users to discontinue use of the product and transition to a supported version. For supported versions, stakeholders are required to apply mitigations in accordance with vendor instructions and CISA’s Binding Operational Directive 26-04.
Defender's checklist
- Identify all instances of Strapi running versions 4.5.5 or earlier in your environment.
- Review admin panel access logs for unusual query filter activity that may indicate data exfiltration.
- Verify if your Strapi version is end-of-life and plan migration to a supported release.
- Ensure compliance with CISA BOD 26-04 patching guidelines for internet-exposed assets.
What to do and how to stay safe: Strapi
- Restrict access to the Strapi admin panel to trusted IP addresses only to reduce the attack surface.
- Rotate all user passwords and invalidate existing password reset tokens immediately, as hashes may have been exposed.
- Monitor server logs for signs of remote code execution attempts, particularly those following successful admin authentication.
- Once the vendor provides an update, apply the patch immediately to resolve the underlying query filter vulnerability.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the deadline to mitigate CVE-2023-22894?
CISA has set a federal due date of October 11, 2026, for applying mitigations or discontinuing use of affected versions.
Can this vulnerability be exploited by external attackers without admin access?
No, the source material states that attackers must have access to the admin panel to exploit this vulnerability and discover sensitive details.
Is there a confirmed fix for this vulnerability?
The source material advises applying mitigations in accordance with vendor instructions or discontinuing use of end-of-life products, but does not confirm a specific patch release.
