CVE-2023-22894 in Strapi: patch now as attacks are confirmed

What CVE-2023-22894 is and who is affectedCVE-2023-22894 is a cleartext storage of sensitive information vulnerability (CWE-312) in Strapi, the open-s...

What CVE-2023-22894 is and who is affected

CVE-2023-22894 is a cleartext storage of sensitive information vulnerability (CWE-312) in Strapi, the open-source headless CMS widely used to power APIs and content back ends. According to the National Vulnerability Database (NVD) of NIST, the flaw affects Strapi from version 3.2.1 (included) up to 4.8.0 (excluded), and was published on 19 April 2023.

The mechanics are subtle rather than spectacular. An attacker who already has access to the admin panel can abuse the query filter to filter users by columns holding sensitive data and infer values from API responses. With super admin access, that can expose password hashes and password reset tokens for all users. With a lower-privileged admin account that can read usernames and emails of API users, the exposure extends to those API users, though not to other admin accounts.

NVD rates it CVSS 3.1: 4.9 (MEDIUM), with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. A medium score can look reassuring, but the prerequisite of admin access is exactly what makes it dangerous in practice: it turns a single compromised or over-privileged account into a route to every credential in the system.

Why it is urgent: confirmed exploitation and a CISA deadline

The score is not the whole story. CISA added CVE-2023-22894 to its Known Exploited Vulnerabilities (KEV) catalogue on 8 October 2026, which means it has been observed in real attacks rather than remaining a theoretical weakness. CISA gave US federal agencies until 11 October 2026 to apply mitigations in line with vendor instructions, under its BOD 26-04 guidance on risk-based security updates, and to follow its forensics triage requirements.

Two further details raise the stakes for any company running Strapi. First, CISA notes that the affected product may be end-of-life or end-of-service, and advises users to discontinue use or move to a supported version. Second, the flaw can be chained with CVE-2023-22621 to achieve remote code execution: what starts as information disclosure can end with an attacker running code on your server. There is no record of use in ransomware campaigns in the CISA entry, but that is cold comfort once credentials and reset tokens are in the wrong hands.

What to do today

Inventory first. Check whether any project, microsite or client portal in your organisation runs Strapi, and confirm the exact version. Anything from 3.2.1 up to 4.8.0 is in scope.
Apply the vendor's guidance. Follow the security disclosure published by Strapi and the release notes for the current supported branch. If the version you run is no longer supported, plan a migration rather than assuming it will be patched.
Look for signs of intrusion. Review admin panel access logs, unusual query patterns against user endpoints, and any account whose privileges exceed what the role requires. Rotate credentials and reset tokens where you suspect exposure.
Reduce what is reachable from the internet. Admin panels should not be openly accessible; restrict them by IP, VPN or a reverse proxy with authentication, and enforce strong authentication and least privilege for every admin account.
Map the blast radius. If Strapi shares a server, database or secrets store with other services, treat those as potentially exposed until you have verified otherwise.

How a cybersecurity team such as ALMC's can help

Situations like this one rarely resolve with a single update. A CMS such as Strapi usually sits inside a wider stack — a reverse proxy, a database, a deployment pipeline, sometimes a WordPress or PrestaShop site on the same infrastructure — and each layer needs checking. At ALMC we work with SMEs, online shops and small IT teams across Lleida, Barcelona, Tarragona and Girona on exactly this kind of problem: security audits and pentesting to find vulnerabilities before they are exploited, server hardening, monitoring and incident response, and recovery of websites that have already been compromised.

For a case like CVE-2023-22894, that means confirming which versions are live, validating that the vendor's fix is properly applied, reviewing who holds admin access and how it is protected, and checking logs for the quiet filtering behaviour this flaw enables. Where exposure has already occurred, we help contain it, rotate what needs rotating and document the response in line with GDPR obligations towards clients and users. The goal is simple: close the gap, prove it is closed, and keep watching.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.