Companies/Strapi Cloud/CVEs

Strapi Cloud CVEs

14 vulnerabilities mapped to Strapi Cloud’s software or packages, 1 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-10

  CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

  CVSS 4.3 mediumEPSS 0.20%

• 2023-04-19

  CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Vulnerability

  CVSS 7.2 highKEV added 2026-10-08EPSS 4.1%

• 2026-09-13

  CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

  CVSS 8.7 highEPSS 0.43%

• 2026-06-29

  CVE-2026-57997 Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration

  CVSS 4.8 mediumEPSS 0.25%

• 2026-05-14

  CVE-2026-27886 Strapi may leak sensitive data via relational filtering due to lack of query sanitization

  CVSS 7.5 highEPSS 1.9%

• 2026-05-14

  CVE-2026-22707 Strapi Upload Plugin MIME Validation Bypass via Content API

  CVSS 5.4 mediumEPSS 0.19%

• 2026-05-14

  CVE-2026-22706 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

  CVSS 6.5 mediumEPSS 0.34%

• 2026-05-14

  CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder

  CVSS 7.2 highEPSS 1.2%

• 2026-05-14

  CVE-2025-64526 Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying

  CVSS 5.3 mediumEPSS 0.49%

• 2025-10-16

  CVE-2025-53092 Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

  CVSS 6.5 mediumEPSS 0.29%

• 2025-10-16

  CVE-2025-25298 Missing Maximum Password Length Validation in Strapi Password Hashing

  CVSS 5.3 mediumEPSS 0.40%

• 2025-10-16

  CVE-2024-56143 Strapi Allows Unauthorized Access to Private Fields via parms.lookup

  CVSS 8.2 highEPSS 0.42%

• 2025-10-16

  CVE-2025-3930 Lack of JWT Expiration after Log Out in Strapi

  CVSS 6.3 mediumEPSS 0.50%

• 2025-05-29

  CVE-2024-52588 Strapi allows Server-Side Request Forgery in Webhook function

  CVSS 4.9 mediumEPSS 0.59%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)