Skip to content
OpenAdvisories

Package · npm

@strapi/admin

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Low 2.1
    CVE-2026-22706 Public exploit

    Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users…

    strapi strapi @strapi/plugin-users-permissions @strapi/admin npm
  • Medium 4.9
    CVE-2024-52588

    Strapi allows Server-Side Request Forgery in Webhook function

    Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery (SSRF). This issue has been patched in versi…

    strapi strapi @strapi/admin npm
  • High 7.3
    CVE-2023-38507

    Strapi Improper Rate Limiting vulnerability

    Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brut…

    strapi strapi @strapi/plugin-users-permissions @strapi/admin npm
  • Medium 5.8
    CVE-2023-36472

    Strapi may leak sensitive user information, user reset password, tokens via content-manager views

    Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove privat…

    strapi strapi @strapi/admin @strapi/utils npm