Skip to content
OpenAdvisories

Package · npm

@strapi/plugin-users-permissions

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-22706 Public exploit

    Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users…

    strapi strapi @strapi/plugin-users-permissions @strapi/admin npm
  • Critical 10.0
    CVE-2023-22621 Public exploit Scanner template EPSS 71%

    Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

    Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the serve…

    @strapi/plugin-users-permissions @strapi/plugin-email npm