Description
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @strapi/strapi | >= 4.0.0-next.0, < 4.1.10 | 4.1.10 | GHSA-4phg-hpqm-c3j4 |
| npm | strapi | < 3.6.10 | 3.6.10 | GHSA-4phg-hpqm-c3j4 |