---
title: "Strapi CVE-2023-22894: 2023 Password-Hash Leak Now in KEV"
url: https://erroneo.us/security/briefs/strapi-cve-2023-22894-private-field-leak-kev/
description: "Strapi before 4.8.0 leaks password hashes and reset tokens via filters, enabling admin takeover and RCE with CVE-2023-22621. Now in KEV. Upgrade to Strapi 5."
type: security-brief
section: "Security Digest"
date_published: 2023-04-17
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-22894", "CVE-2023-22621"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Strapi CVE-2023-22894: 2023 Password-Hash Leak Now in KEV

**Verdict: Check exposure.** Only Strapi builds older than 4.8.0 (March 2023) are affected, but on those an unauthenticated attacker can take over the super admin, so any you find should be upgraded or taken offline today.

- **Who must act:** Anyone running Strapi v3 (from 3.2.1) or v4 below 4.8.0, especially internet-facing instances with publicly readable collections; v4.5.5 and older are also open to remote code execution through CVE-2023-22621.
- **Who can relax:** Teams on Strapi 5 or on v4 4.8.0 and later, which are not affected by this CVE, though v4 itself stopped receiving security updates in April 2026.
- **Affected:** Strapi 3.2.1 through 4.7.x (fixed in 4.8.0); CVE-2023-22621: all Strapi v3 and v4 before 4.5.6; Strapi v3 never received a fix (end-of-life since end of 2022)
- **Fixed:** Strapi 4.8.0 (CVE-2023-22894); Strapi 4.5.6 (CVE-2023-22621); Strapi 5.x (the only supported line as of Oct 2026)
- **CVEs:** CVE-2023-22894, CVE-2023-22621
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Strapi deployment and its version with npm ls @strapi/strapi, including containers and forgotten staging sites.
2. Upgrade anything below 4.8.0; target Strapi 5, since v4 no longer gets security fixes.
3. Until upgraded, put /admin and the API behind a VPN or allowlist, and review which collections the Public role can read.
4. Run Strapi's log grep for filters on email, password and reset-token fields; on any hits, start incident response.
5. If exposure is possible, reset admin and API user passwords, rotate ADMIN_JWT_SECRET, JWT_SECRET, API_TOKEN_SALT, APP_KEYS and API tokens, and review admin accounts and email templates.

### How to check if you are affected

- Search request logs with Strapi's pattern: grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)'; repeated hits on password or reset-token fields mean hashes and tokens were likely leaked.
- Look for PUT requests to /users-permissions/email-templates, then inspect email templates for code inside <% %> blocks beyond the standard variables.
- Check for unexpected super admin password resets, new admin users, new API tokens, and processes spawned by the Node.js server.

## What happened

CVE-2023-22894 lets an attacker filter Strapi queries on private fields, such as a user's email, password hash and password reset token, and work out each value from how the results change. Strapi fixed it in [v4.8.0](https://github.com/strapi/strapi/releases/tag/v4.8.0) on March 15, 2023, holding back the details. It published the [full disclosure](https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve) on April 17, 2023, the same day the researcher GhostCcamm published a [write-up](https://www.ghostccamm.com/blog/multi_strapi_vulns/). The researcher summed up the root cause: "Strapi just removes private fields from query results and does not remove private fields from the actual query." An attacker can then recover a hash or token one character at a time with `$startsWith` filters.

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-22894) and CISA describe an attacker "with access to the admin panel." Strapi's own timeline goes further. On January 21, 2023, the researcher found a way to exploit the bug "as an unauthenticated user on all Strapi servers." Strapi automatically links entries an admin creates or updates to that admin, so any publicly readable collection containing admin-authored entries becomes a path to the admin's record. The chain works like this: leak the super admin's email, trigger a password reset, leak the reset token, and set a new password. On Strapi 4.5.5 and older, the attacker can then abuse CVE-2023-22621, a server-side template injection in the users-permissions email templates fixed in 4.5.6 (January 11, 2023), to run code on the server.

The reason for KEV now: on October 8, 2026, the joint advisory [AA26-281A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a), from the FBI, CISA, NSA and six partner countries, listed CVE-2023-22894 among eight CVEs "successfully exploited" by China-linked actors enabled by Integrity Technology Group. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894) the same day, with an October 11 deadline. The advisory says nothing about when, how or against whom Strapi was exploited, and we found no other public 2026 reporting. CVE-2023-22621 is not in KEV as of Oct 21, 2026.

## Who is affected

Strapi, [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-22894) and [GHSA-jjqf-j4w7-92w8](https://github.com/advisories/GHSA-jjqf-j4w7-92w8) list versions 3.2.1 up to but not including 4.8.0. GhostCcamm's write-up says 4.7.1 and older, and AA26-281A says up to 4.5.5. The full remote code execution chain needs a version below 4.5.6 ([GHSA-2h87-4q2w-v4hf](https://github.com/advisories/GHSA-2h87-4q2w-v4hf)). Strapi v3 reached end-of-life at the end of 2022 and never got a fix. According to Strapi's [security policy](https://github.com/strapi/strapi/blob/main/SECURITY.md), v4 stopped receiving security updates in April 2026, leaving 5.x as the only supported line. The instances still at risk are typically marketing sites, app backends and internal content tools built in 2021 or 2022 and never upgraded.

## Do you really need to act?

If you don't run Strapi, or you run Strapi 5, no. If you run v4 at 4.8.0 or later, this CVE does not affect you, but you are on an end-of-life line, so plan the move to v5. If you run anything older than 4.8.0 and it is reachable from the internet, treat it as urgent and ignore the "admin access" wording. NVD scores it 4.9 and CISA's ADP 7.2, both assuming high privileges. Strapi's own vector, `AV:N/AC:L/PR:N/UI:N` with high impact on confidentiality, integrity and availability, reflects the unauthenticated takeover, and Strapi rated the bug Critical.

## What to do now

1. Find versions: run `npm ls @strapi/strapi` in each project, and check running containers and old staging hosts.
2. Upgrade anything below 4.8.0, aiming for Strapi 5. A v4 upgrade to 4.8.0 or later closes both CVEs, but v4 is still unsupported.
3. Until then, restrict `/admin` and the API to a VPN or IP allowlist, and review the Public role's permissions under Settings > Users & Permissions.
4. If the log check below finds anything, reset every admin and API user password, rotate `ADMIN_JWT_SECRET`, `JWT_SECRET`, `API_TOKEN_SALT`, `APP_KEYS` and API tokens, and audit admin users.
5. On 4.5.5 or older with signs of compromise, rebuild the server rather than upgrading in place.

## How to tell if you were hit

Strapi says exploitation is "easily detectable" because the payload sits in GET parameters. Its suggested command is `grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)' $PATH_TO_LOG_FILE`. Many matching requests on `password` or reset-token fields mean hashes and tokens have probably leaked, and Strapi says to start incident response immediately. For CVE-2023-22621, look for `PUT` requests to `/users-permissions/email-templates`. Then check the reset-password and confirmation templates for code inside `<% %>` blocks other than the standard `URL`, `TOKEN` or `CODE` variables. Also watch for unexplained admin password resets and new admin users or API tokens.

## Timeline

- Jan 3, 2023 — CVE-2023-22894 is reported to Strapi as an admin-only, Medium-severity issue.
- Jan 11, 2023 — Strapi 4.5.6 fixes CVE-2023-22621.
- Jan 21, 2023 — The researcher demonstrates unauthenticated exploitation and an unauthenticated RCE chain.
- Mar 15, 2023 — Strapi 4.8.0 fixes CVE-2023-22894.
- Apr 17, 2023 — Full public disclosure. The CVE is published April 19.
- Oct 8, 2026 — AA26-281A names it as exploited, and CISA adds it to KEV ([coverage](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)).
- Oct 11, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Strapi — Security Disclosure of Vulnerabilities: CVE-2023-22893, CVE-2023-22621, and CVE-2023-22894](https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve)
2. [CVE record — CVE-2023-22894](https://www.cve.org/CVERecord?id=CVE-2023-22894)
3. [NVD — CVE-2023-22894](https://nvd.nist.gov/vuln/detail/CVE-2023-22894)
4. [CISA — Known Exploited Vulnerabilities: CVE-2023-22894](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894)
5. [Strapi / GitHub — Release v4.8.0](https://github.com/strapi/strapi/releases/tag/v4.8.0)
6. [Strapi / GitHub — Security Policy (supported versions)](https://github.com/strapi/strapi/blob/main/SECURITY.md)
7. [GitHub Advisory Database — GHSA-jjqf-j4w7-92w8 (CVE-2023-22894)](https://github.com/advisories/GHSA-jjqf-j4w7-92w8)
8. [GitHub Advisory Database — GHSA-2h87-4q2w-v4hf (CVE-2023-22621)](https://github.com/advisories/GHSA-2h87-4q2w-v4hf)
9. [GhostCcamm — Multiple Critical Vulnerabilities in Strapi Versions <=4.7.1](https://www.ghostccamm.com/blog/multi_strapi_vulns/)
10. [CISA, FBI, NSA et al. — AA26-281A: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a)
11. [The Hacker News — Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies](https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)

---
Source page: https://erroneo.us/security/briefs/strapi-cve-2023-22894-private-field-leak-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt