Skip to content
OpenAdvisories

Product · strapi

@strapi/plugin-users-permissions

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.9
    CVE-2025-64526

    Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

    Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on routes whose body schema …

    strapi strapi @strapi/plugin-users-permissions @strapi/plugin-users-permissions npm