CVE entry · CVE-2023-22894
CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
- Actively exploited: added to CISA’s KEV catalog on October 8, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: October 11, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Strapi, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.