CVE-2023-22894Strapi query filter leaks password hashes and reset tokens
What broke
Strapi's query filters allowed filtering on private user fields. An attacker could filter users by a column such as the password hash or the reset password token and infer its value from the API's responses. Strapi's disclosure of April 17, 2023 says the flaw affects 3.2.1 up to 4.8.0 and is fixed in 4.8.0, released March 15, 2023. It leaked email addresses, password hashes and reset password tokens.
NVD's description says the attacker needs admin panel access and scores it CVSS 3.1 4.9, with CWE-312. Strapi's timeline says the researcher later showed that unauthenticated users could exploit it and that it could be used to hijack admin accounts, and the severity was raised to critical. Chained with the template injection CVE-2023-22621, the researcher's proof of concept reached unauthenticated remote code execution on Strapi 4.5.5 and earlier. CISA added CVE-2023-22894 to KEV on October 8, 2026, 1,270 days after disclosure, and notes that affected versions may be end of life.
Why it matters
A password reset token is a password. Whoever reads it can set a new password for that account, and a leaked admin reset token turns a content API into an admin login. Strapi stored the token in a column the filter layer could reach, so access control on the record did not protect the field. The lesson for anyone running their own login is to keep reset tokens hashed, short-lived and single-use, and never queryable through the general data API.
What to do
- Upgrade Strapi to 4.8.0 or later. Strapi v3 is end of life and gets no fix.
- Search request logs for bracketed GET parameters naming
email,password,reset_password_tokenorresetPasswordToken. Strapi says many such requests mean hashes and tokens were leaked. - Search for
PUTrequests to/users-permissions/email-templatesand template code in<%...%>blocks, the CVE-2023-22621 indicator.
After you patch
- Invalidate all outstanding reset tokens and force password resets for admin and API users.
- Rotate the JWT secret and API tokens if you find leak indicators.
Sources
Related on Start with Identity
- CVEKeycloak reset-credentials flow skips the email token, full account takeover
Improper state validation in Keycloak's reset-credentials authentication flow let an unauthenticated attacker jump straight to the password-update step, no emai
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- CVEJetBrains TeamCity 2023 authentication bypass to RCE
Unauthenticated request becomes administrator, then code execution, on TeamCity On-Premises before 2023.05.4. CVSS 9.8. CISA KEV. Used by Russian state actors.
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a