10 October 2026
Reference: CVE-2023-22894
1. What is being reported?
The vulnerability affects Strapi versions up to 4.5.5. If someone gains access to the Strapi admin panel, they can use a flaw in the system’s user query filters to see sensitive information about users. Super admins can see password hashes and reset tokens for all users, while other admins with some permissions can see sensitive details for users with lower roles.
2. What this means in plain English
If an attacker gets into your Strapi admin panel, they could potentially access sensitive user data, which might lead to further attacks or data breaches. This risk is higher if your organisation uses Strapi to manage user accounts or sensitive information.
3. Could this affect a small business?
Small businesses or organisations using Strapi for their websites or applications could be affected, especially if they have multiple user roles and admin access. If you do not use Strapi or do not allow external admin access, you are less likely to be impacted.
4. What to do now
- Check if your organisation uses Strapi and identify the version in use.
- Ask your IT provider or software supplier if the Strapi installation is updated beyond version 4.5.5 or if patches are available.
- Restrict admin panel access to trusted personnel only and review user permissions carefully.
- Apply any vendor-provided mitigations or updates promptly following official guidance.
5. Ask your IT provider
Can you confirm if our Strapi installation is updated to a version that fixes CVE-2023-22894, or if there are mitigations in place to protect against this vulnerability?
6. Bottom line
If you use Strapi, ensure it is updated or protected to prevent attackers from accessing sensitive user information through the admin panel.
Information based on CISA KEV, NVD, and reputable security reporting.