Skip to content
OpenAdvisories
High WID-SEC-2026-1552 5 CVEs

Strapi: Mehrere Schwachstellen

Published May 14, 2026 · Updated May 14, 2026 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Strapi ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Administratorrechte zu erlangen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.

Product

Strapi ist ein headless Content-Management-System (CMS), dass als Open-Source-Software entwickelt wird.

Vulnerabilities 5

  • Critical 9.3
    CVE-2026-22599 Public exploit

    Strapi Vulnerable to SQL Injection in Content Type Builder

    Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated a…

    strapi strapi @strapi/content-type-builder @strapi/content-type-builder npm
  • Critical 9.2
    CVE-2026-27886 Public exploit Scanner template

    Strapi may leak sensitive data via relational filtering due to lack of query sanitization

    Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` q…

    strapi strapi @strapi/strapi npm
  • Medium 6.9
    CVE-2025-64526

    Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

    Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on routes whose body schema …

    strapi strapi @strapi/plugin-users-permissions @strapi/plugin-users-permissions npm
  • Medium 5.3
    CVE-2026-22707

    Strapi Upload Plugin MIME Validation Bypass via Content API

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions (`plugin.upload.security.allowedTypes` and `deniedTy…

    strapi strapi @strapi/upload @strapi/upload npm
  • Low 2.1
    CVE-2026-22706 Public exploit

    Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users…

    strapi strapi @strapi/plugin-users-permissions @strapi/admin npm

Revision history

  1. #1

    Initiale Fassung

References