Skip to content
OpenAdvisories

Vendor

strapi

29 known vulnerabilities.

Products

strapi 25 Strapi Open Source and Enterprise Headless CMS 3 @strapi/plugin-users-permissions 2 strapi/strapi 1 @strapi/admin 1 @strapi/upload 1 @strapi/content-type-builder 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-118170

    CVE-2026-118170

    The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.

    strapi Strapi Open Source and Enterprise Headless CMS
  • Critical 9.2
    CVE-2026-27886 Public exploit Scanner template

    Strapi may leak sensitive data via relational filtering due to lack of query sanitization

    Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` q…

    strapi strapi @strapi/strapi npm
  • Critical 9.3
    CVE-2026-22599 Public exploit

    Strapi Vulnerable to SQL Injection in Content Type Builder

    Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated a…

    strapi strapi @strapi/content-type-builder @strapi/content-type-builder npm