Skip to content
OpenAdvisories

Vendor

strapi

29 known vulnerabilities.

Products

strapi 25 Strapi Open Source and Enterprise Headless CMS 3 @strapi/plugin-users-permissions 2 strapi/strapi 1 @strapi/admin 1 @strapi/upload 1 @strapi/content-type-builder 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-22706 Public exploit

    Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users…

    strapi strapi @strapi/plugin-users-permissions @strapi/admin npm
  • Low 2.3
    CVE-2024-29181

    @strapi/plugin-content-manager leaks data via relations via the Admin Panel

    Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of a…

    strapi strapi @strapi/plugin-content-manager npm