# Strapi query filter leaks password hashes and reset tokens

Source: https://startwithidentity.com/cves/cve-2023-22894/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

Strapi's query filters allowed filtering on private user fields. An attacker could filter users by a column such as the password hash or the reset password token and infer its value from the API's responses. Strapi's disclosure of April 17, 2023 says the flaw affects 3.2.1 up to 4.8.0 and is fixed in 4.8.0, released March 15, 2023. It leaked email addresses, password hashes and reset password tokens.

NVD's description says the attacker needs admin panel access and scores it CVSS 3.1 4.9, with CWE-312. Strapi's timeline says the researcher later showed that unauthenticated users could exploit it and that it could be used to hijack admin accounts, and the severity was raised to critical. Chained with the template injection CVE-2023-22621, the researcher's proof of concept reached unauthenticated remote code execution on Strapi 4.5.5 and earlier. CISA added CVE-2023-22894 to KEV on October 8, 2026, 1,270 days after disclosure, and notes that affected versions may be end of life.

## Why it matters

A password reset token is a password. Whoever reads it can set a new password for that account, and a leaked admin reset token turns a content API into an admin login. Strapi stored the token in a column the filter layer could reach, so access control on the record did not protect the field. The lesson for anyone running their own login is to keep reset tokens hashed, short-lived and single-use, and never queryable through the general data API.

## What to do

- Upgrade Strapi to 4.8.0 or later. Strapi v3 is end of life and gets no fix.
- Search request logs for bracketed GET parameters naming `email`, `password`, `reset_password_token` or `resetPasswordToken`. Strapi says many such requests mean hashes and tokens were leaked.
- Search for `PUT` requests to `/users-permissions/email-templates` and template code in `<%...%>` blocks, the CVE-2023-22621 indicator.

## After you patch

- Invalidate all outstanding reset tokens and force password resets for admin and API users.
- Rotate the JWT secret and API tokens if you find leak indicators.

## Sources

- [NVD: CVE-2023-22894](https://nvd.nist.gov/vuln/detail/cve-2023-22894)
- [Strapi: Security disclosure of CVE-2023-22893, CVE-2023-22621 and CVE-2023-22894](https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve)
- [CISA Known Exploited Vulnerabilities catalog, added October 8, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894)