CVE-2023-22894Strapi query filter leaks password hashes and reset tokens
What broke
Strapi's query filters allowed filtering on private user fields. An attacker could filter users by a column such as the password hash or the reset password token and infer its value from the API's responses. Strapi's disclosure of April 17, 2023 says the flaw affects 3.2.1 up to 4.8.0 and is fixed in 4.8.0, released March 15, 2023. It leaked email addresses, password hashes and reset password tokens.
NVD's description says the attacker needs admin panel access and scores it CVSS 3.1 4.9, with CWE-312. Strapi's timeline says the researcher later showed that unauthenticated users could exploit it and that it could be used to hijack admin accounts, and the severity was raised to critical. Chained with the template injection CVE-2023-22621, the researcher's proof of concept reached unauthenticated remote code execution on Strapi 4.5.5 and earlier. CISA added CVE-2023-22894 to KEV on October 8, 2026, 1,270 days after disclosure, and notes that affected versions may be end of life.
Why it matters
A password reset token is a password. Whoever reads it can set a new password for that account, and a leaked admin reset token turns a content API into an admin login. Strapi stored the token in a column the filter layer could reach, so access control on the record did not protect the field. The lesson for anyone running their own login is to keep reset tokens hashed, short-lived and single-use, and never queryable through the general data API.
What to do
- Upgrade Strapi to 4.8.0 or later. Strapi v3 is end of life and gets no fix.
- Search request logs for bracketed GET parameters naming
email,password,reset_password_tokenorresetPasswordToken. Strapi says many such requests mean hashes and tokens were leaked. - Search for
PUTrequests to/users-permissions/email-templatesand template code in<%...%>blocks, the CVE-2023-22621 indicator.
After you patch
- Invalidate all outstanding reset tokens and force password resets for admin and API users.
- Rotate the JWT secret and API tokens if you find leak indicators.
Sources
Related on Start with Identity
- CVEKeycloak reset-credentials flow skips the email token, full account takeover
Improper state validation in Keycloak's reset-credentials authentication flow let an unauthenticated attacker jump straight to the password-update step, no emai
- CVEJetBrains TeamCity 2023 authentication bypass to RCE
Unauthenticated request becomes administrator, then code execution, on TeamCity On-Premises before 2023.05.4. CVSS 9.8. CISA KEV. Used by Russian state actors.
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C