CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability

What it is

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

What to do

Fix within your normal patch cycle and well before the CISA date. Check that your scanning covers this product so nothing is missed.

Priority

Plan: Fix within your normal patch cycle, before the CISA date.

Severity (CVSS)

4.9 medium

CISA assessment (SSVC)

actively exploited; needs manual effort per target; total control of the affected system

Exploit probability (EPSS, 30 days)

3.6%, higher than 89% of all CVEs

Added to CISA KEV

8 October 2026

CISA fix-by date

11 October 2026 (US federal agencies; a sensible deadline for everyone)

Ransomware use

Not known

Weakness

CWE-312

References

• NIST NVD entry
• CISA KEV entry
• github.com/strapi/strapi/releases
• strapi.io/blog/security-disclosure-of-vulnerabilities-cve
• www.ghostccamm.com/blog/multi_strapi_vulns/
• github.com/strapi/strapi/releases
• strapi.io/blog/security-disclosure-of-vulnerabilities-cve
• www.ghostccamm.com/blog/multi_strapi_vulns/

Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.