CVE-2026-27886
HighSummary
Strapi is an open-source content management system that in versions from 4.0.0 to prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter to perform a boolean-oracle attack against private fields in the `admin_users` table, allowing for administrative account takeover.
Risk Assessment
The risk to the organization is the potential for an attacker to take over an administrator account without authentication, which could lead to unauthorized access to sensitive data and system functions.
Recommendation
It is recommended to update Strapi to version 5.37.0 or later to patch this vulnerability and to review and strengthen query parameter sanitization in the application.
Other vulnerabilities in Strapi
See all- CVE-2026-57997Medium
The Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.
- CVE-2023-34235High
Strapi, an open-source content management system, prior to version 4.10.8, allows leaking private fields when using the `t(number)` prefix. Changing the prefix in Knex queries can expose protected data such as admin passwords.
- CVE-2023-34093Medium
Strapi, an open-source content management system, prior to version 4.10.8 allowed anyone to make content-type attributes public without realizing it. This vulnerability could lead to sensitive information being exposed as users might unknowingly remove the privateAttributes protection mechanism.
- CVE-2022-32114High
An unrestricted file upload vulnerability in Strapi 4.1.12's Add New Assets function allows XSS attacks via a crafted PDF file. The project documentation notes that users with Media Library upload permissions can upload PDFs containing JavaScript, and all files in the public assets folder are externally accessible.
Original NVD description (English source)
Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` (or other admin-relation) field to perform a boolean-oracle attack against private fields on the joined `admin_users` table, including the `resetPasswordToken` field. Extracting an admin reset token via this oracle made full administrative account takeover possible without authentication. When a filter such as `where[updatedBy][resetPasswordToken][$startsWith]=a` was applied to a public Content API endpoint, the underlying query generation performed a `LEFT JOIN` against the `admin_users` table and emitted a `WHERE` clause referencing the joined column. The query parameter sanitization layer did not block operator chains that traversed into relational target