CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information

Background

Strapi is an open-source headless content management system (CMS) widely used to build APIs that power websites, mobile apps, and other content-driven products. Like many CMS platforms, Strapi has an administrative panel through which site operators manage content, users, and configuration — a surface that is typically restricted to trusted staff but that nonetheless processes and stores sensitive data, including details about the end users and contributors whose accounts the CMS manages.

CISA’s KEV notes flag that the impacted versions of Strapi “could be end-of-life (EoL) and/or end-of-service (EoS),” and explicitly recommend that users discontinue use of affected versions and transition to a supported release rather than relying solely on a patch. This framing matters: organizations still running old, unsupported Strapi instances are not just missing a single fix, they are running on a product line that may no longer receive security maintenance at all.

Technical Mechanism

This vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information). Per CISA’s description, Strapi “contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter.”

Mechanically, this describes a case where sensitive user data — the KEV description does not specify precisely which fields, but user-detail information of this kind in a CMS context typically includes things like email addresses, internal identifiers, or other account metadata — is stored without encryption or masking, and is then exposed through Strapi’s query filter functionality. Query filters in CMS admin panels are typically a feature meant to let administrators search and filter content or user records (for example, filters[field][$eq]=value-style query parameters in Strapi’s REST API). Because the underlying sensitive fields are stored in cleartext rather than encrypted or redacted at rest, a query filter that was designed for legitimate administrative searching can also be used to directly retrieve or infer the sensitive values themselves, rather than just matching against them.

The prerequisite for exploitation is access to the Strapi admin panel — this is not an unauthenticated, fully remote bug on its own. However, CISA’s notes add an important chaining detail: “this vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.” That means CVE-2023-22894’s practical severity is higher than a standalone information-disclosure bug would suggest — an attacker who first gains any form of admin-panel access (through a separate vulnerability, weak credentials, or another chained flaw such as CVE-2023-22621) can use this bug to harvest sensitive user details, and potentially leverage the combination to escalate further toward code execution on the underlying server.

Real-World Exploitation Evidence

CVE-2023-22894 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 2026-10-08. KEV listing is CISA’s formal confirmation that it has evidence of active exploitation of this vulnerability in the wild.

CISA’s knownRansomwareCampaignUse field for this entry is marked “Unknown” — CISA has not confirmed use of this vulnerability in ransomware campaigns at this time. No specific threat actor or named campaign is attributed to exploitation of this CVE in the data available here. No specific threat actor has been publicly attributed to exploitation of this CVE; its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. Given CISA’s note that affected versions “could be end-of-life,” opportunistic targeting of abandoned, unpatched Strapi instances that are no longer actively maintained by their operators is a reasonable general framing of the exploitation pattern, but that is inference from the EoL status rather than a confirmed campaign detail.

Impact Assessment

A CVSS score of 7.2 (high) reflects a confidentiality-dominant impact, consistent with CWE-312’s nature: the primary consequence is unauthorized disclosure of sensitive user information rather than direct system compromise. However, the documented chaining potential with CVE-2023-22621 means the realistic worst-case impact for an affected, unpatched instance extends to remote code execution — a far more severe outcome than information disclosure alone.

Practical consequences include:

• Exposure of sensitive end-user data — email addresses, account identifiers, or other personal details stored by the CMS, with downstream risk of further phishing, account takeover, or privacy/regulatory exposure depending on what data is involved and applicable data-protection obligations
• Escalation path to full compromise — via chaining with CVE-2023-22621, an attacker can potentially move from reading sensitive data to executing arbitrary code on the Strapi server, which would expose the entire content database, any connected systems, and the hosting environment itself
• End-of-life exposure — organizations running EoL/EoS Strapi versions face compounding risk: even after addressing this specific CVE, an unsupported CMS version will not receive fixes for future vulnerabilities, making migration to a supported release the only durable remediation
• Sector framing — this risk applies broadly to any organization using Strapi as a headless CMS backend, with particular concern for sites handling registered-user data (membership sites, SaaS products with user-generated content, e-commerce platforms) where the “sensitive user details” at stake directly implicate customer or member privacy

Affected Versions

CISA’s notes do not provide a specific version table in the data available for this write-up, beyond stating that impacted versions could be end-of-life or end-of-service. Strapi’s own security disclosure process and GitHub releases (linked below) are the authoritative source for the exact affected and patched version ranges.

Because CISA explicitly flags possible EoL/EoS status, organizations should determine not only whether their Strapi version has a direct patch available, but whether that version line is still supported at all — if not, migration to a current, supported Strapi release is the recommended path rather than attempting to patch an abandoned branch.

Remediation Steps

1. Identify the Strapi version in use across all deployments:

   npx strapi version

2. Consult Strapi’s official security disclosure page and GitHub releases (linked below) to determine whether your version has a direct security patch, or whether it falls into the end-of-life range CISA references.
3. If a direct patch is available, apply it and redeploy:

   npm install strapi@latest
   npm run build

4. If your installation is end-of-life or end-of-service, prioritize migration to a current, supported Strapi major version rather than relying on a point patch — per CISA’s own guidance for EoL products, discontinuing use of the unsupported version is the recommended action where mitigations are unavailable.
5. Also review and remediate CVE-2023-22621 in the same environment, given the documented chaining risk — patching CVE-2023-22894 alone does not close the escalation path if the chained vulnerability remains unaddressed.
6. Restrict admin-panel access to trusted networks and accounts only (VPN, IP allowlisting, strong authentication/MFA for admin accounts), reducing the pool of parties who could reach the vulnerable query-filter functionality in the first place.
7. Apply mitigations in accordance with CISA’s BOD 26-04 guidance, and follow applicable cloud-service guidance or discontinue use of the product if mitigations are unavailable.

Detection Guidance

• Admin panel access logs — review authentication and access logs for the Strapi admin panel for logins from unexpected accounts, IP addresses, or geographies, particularly any access followed by unusual query-filter API calls against user-related content types
• Query filter usage patterns — look for anomalous or unusually broad filter queries against user/account endpoints (e.g., filters[...] parameters targeting sensitive fields in rapid succession or in a pattern inconsistent with normal administrative search behavior) in Strapi’s API access logs
• Chained-exploit indicators — if investigating a suspected CVE-2023-22894 event, also check for indicators associated with CVE-2023-22621 in the same timeframe, given the documented chaining relationship toward code execution
• Exact signatures and log field names should be confirmed against Strapi’s own security documentation and any web application firewall (WAF) or IDS feed covering CMS-specific attack patterns, since precise request signatures are not published in the data available for this write-up

Timeline

References

• Strapi — Security Disclosure of Vulnerabilities
• Strapi GitHub Releases
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2023-22894