Strapi CVE-2023-22894: Sensitive Information Exposure and RCE Chain

Catalog analysis: CISA added this entry on October 08, 2026. The entry reflects catalog information retrieved on October 09, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2023-22894 is a vulnerability in Strapi involving the cleartext storage of sensitive information (CWE-312). The flaw allows an attacker who has already gained access to the admin panel to discover sensitive user details by utilizing the query filter. While this vulnerability primarily results in information disclosure, it is critical for defenders to note that it can be chained with CVE-2023-22621 to achieve remote code execution (RCE).

Exposure and applicability

This vulnerability applies to Strapi installations where the admin panel is accessible. The risk is significantly elevated if the environment also contains the conditions necessary for CVE-2023-22621, as this transforms a data exposure issue into a full system compromise path.

Infrastructure owners should be aware that some impacted versions of the product may be end-of-life (EoL) or end-of-service (EoS), meaning official patches for those specific legacy versions may not be available.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize assets based on their internet exposure and version status:

1. Immediate Transition: For assets running EoL or EoS versions of Strapi, the priority is to discontinue use or transition to a currently supported version, as mitigations for obsolete versions may be unavailable.
2. Version Alignment: Update Strapi installations to a supported version that addresses both CVE-2023-22894 and CVE-2023-22621 to break the RCE chain.
3. Access Restriction: Limit access to the admin panel to trusted networks or authenticated users only, reducing the likelihood of an attacker reaching the query filter.

How to validate remediation

Verifying that a vulnerability is mitigated requires more than a version check, especially when dealing with EoL software. Defenders should employ the following validation methods:

• Configuration Audit: Confirm that the admin panel is no longer exposed to untrusted networks and that access controls are strictly enforced.
• Version Verification: Ensure the deployed version matches a known supported release that explicitly addresses these CVEs.
• Functional Testing: In a staged environment, verify if sensitive user details remain accessible via the query filter using an account with admin panel access. A successful mitigation is indicated by the inability to retrieve this sensitive data through the filter.

Limits and open questions

Applying a patch or updating versions may not eliminate all risk if the underlying infrastructure remains misconfigured or if other unpatched vulnerabilities exist in the environment. Because some affected products are EoL/EoS, there is a residual risk that legacy systems cannot be fully secured without a complete platform migration.

It remains unknown whether this vulnerability has been utilized by ransomware campaigns, though its inclusion in the CISA Known Exploited Vulnerabilities catalog indicates active exploitation in the wild.

Source and editorial note

CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability · Source date: October 08, 2026 · Retrieved October 09, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment