CVE-2023-22894: Strapi Admin Panel Leaks Password Hashes and Reset Tokens

What Is the Flaw?

CVE-2023-22894 is classified under CWE-312 – Cleartext Storage of Sensitive Information. It affects Strapi through version 4.5.5, a popular open-source headless CMS.

The root cause is that Strapi's admin-panel API allows query filters to be applied against database columns that hold sensitive fields — including password hashes and password-reset tokens — without restricting which columns can be queried. By crafting filter parameters and observing API responses, an authenticated admin can iteratively infer the values of those fields, even though they are never directly returned in full.

Two exploitation tiers exist depending on the attacker's privilege level:

• Super-admin access: Enables discovery of the password hash and password-reset token for every user in the system.
• Lower-privilege admin access (e.g., an account that can read Editor or Author usernames and emails): Enables discovery of sensitive information for all API-level users, though not for other admin accounts.

CISA's KEV entry further notes that this vulnerability can be chained with CVE-2023-22621 to achieve remote code execution, significantly elevating real-world risk beyond the standalone CVSS score.

Who and What Is Affected?

The vulnerability affects Strapi versions up to and including 4.5.5. Any organization running Strapi as a backend or headless CMS — regardless of industry — should treat this as a high-priority issue.

CISA's KEV advisory specifically flags that affected product versions could be end-of-life (EoL) or end-of-service (EoS), meaning security patches from the vendor may no longer be forthcoming for those release lines. This makes migration to a currently supported version the only sustainable remediation path.

Exposure factors that increase organizational risk include:

• Strapi admin panels accessible from the public internet.
• Multiple admin accounts with varying privilege levels (each is a potential attacker pivot point).
• Instances where Strapi manages credentials or tokens for downstream systems or third-party integrations.
• Environments where CVE-2023-22621 (a separate Strapi flaw) is also unpatched, enabling chained remote code execution.

Impact and Severity

The NVD rates this vulnerability CVSS 3.1 score 4.9 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The score reflects that high-privilege (admin) access is a prerequisite — but once that bar is cleared, the confidentiality impact is rated High.

In practice, the risk profile is worse than the standalone score suggests:

• Password hashes exposed: Even hashed passwords can be attacked offline using dictionary or brute-force techniques, potentially yielding plaintext credentials if weak passwords or outdated hashing algorithms are in use.
• Password-reset tokens exposed: An attacker who obtains a valid reset token can take over any user account without knowing the password, bypassing authentication entirely.
• Chaining with CVE-2023-22621: Per CISA's KEV summary, combining this flaw with CVE-2023-22621 can lead to full remote code execution on the host server.
• CISA KEV listing (added 2026-10-08): CISA's inclusion confirms this vulnerability is being actively exploited in the wild and requires urgent action under BOD 26-04.

What to Do Now

CISA's required action under BOD 26-04 is to apply vendor mitigations or, if mitigations are unavailable, to discontinue use of the product. The following steps represent a defensible response:

1. Inventory all Strapi instances. Identify every deployment in your environment, including development, staging, and production, and determine their current versions.
2. Upgrade to a supported Strapi version immediately. Versions at or below 4.5.5 are the confirmed affected range. Migrate to a currently maintained release and review the vendor's official release notes and security advisories at strapi.io.
3. Rotate all credentials and tokens. Assume that password hashes and reset tokens for all users may have been enumerated. Force password resets for all accounts and invalidate existing reset tokens.
4. Restrict admin-panel access. Place Strapi admin interfaces behind a VPN or IP allowlist to limit the attack surface for this and similar authenticated vulnerabilities.
5. Patch CVE-2023-22621 simultaneously. Because these two flaws can be chained for RCE, treating them as a single remediation unit is strongly advised.
6. Review access logs. Look for unusual query-filter patterns against the users API endpoint that may indicate prior exploitation. CISA's forensics triage guidance (referenced in the KEV entry) provides additional direction.
7. Assess EoL status. If your Strapi version is end-of-life, the vendor may not issue patches. In that case, discontinuing use or upgrading is the only viable path.

Federal agencies subject to BOD 26-04 must comply with its patching timelines. All organizations are encouraged to treat CISA KEV entries as high-priority regardless of regulatory mandate.

Primary references: NVD – CVE-2023-22894 | CISA KEV Catalog

How Continuous External Testing Surfaces This Exposure

CVE-2023-22894 illustrates a class of risk that internal patch management alone can miss: internet-exposed admin panels running vulnerable software versions. Organizations often have shadow deployments — development or staging Strapi instances that were stood up quickly and never formally tracked — that persist long past their intended lifecycle.

Continuous external attack surface monitoring catches this category of exposure by:

• Discovering internet-facing Strapi instances across all IP ranges and subdomains, including those not in the official asset register.
• Fingerprinting software versions from HTTP headers, response bodies, and other observable signals to flag unpatched or EoL deployments.
• Alerting on newly exposed admin interfaces that appear between scheduled scan cycles, reducing the window of undetected exposure.
• Correlating findings against CISA KEV and NVD so that high-priority, actively exploited vulnerabilities like CVE-2023-22894 are surfaced immediately rather than waiting for the next quarterly assessment.
• Tracking chained vulnerability sets — identifying assets vulnerable to both CVE-2023-22894 and CVE-2023-22621 simultaneously, where the combined risk substantially exceeds the individual CVSS scores.

The goal is not to simulate an attack but to give defenders the same visibility an attacker already has: a continuously updated map of what is exposed and what version it is running.

Frequently asked questions

Does an attacker need admin credentials to exploit CVE-2023-22894?

Yes. The vulnerability requires authenticated access to the Strapi admin panel. A super-admin can expose all users' password hashes and reset tokens; a lower-privilege admin can expose sensitive details for API-level users but not other admin accounts. That said, CISA's KEV listing confirms real-world exploitation is occurring, so the prerequisite is not a sufficient barrier.

My Strapi instance is not publicly accessible. Am I still at risk?

Restricting access to the admin panel significantly reduces the attack surface, but it does not eliminate risk from insider threats or compromised admin accounts. Upgrading to a supported version and rotating credentials remains the recommended remediation regardless of network exposure.

Why does the CVSS score say Medium if CISA added this to the KEV?

The CVSS score of 4.9 reflects the standalone flaw with high-privilege prerequisites. CISA's KEV listing is based on confirmed in-the-wild exploitation and accounts for real-world factors — including the ability to chain CVE-2023-22894 with CVE-2023-22621 for remote code execution — that CVSS alone does not fully capture. Organizations should weight the KEV status heavily in prioritization decisions.

What if my Strapi version is end-of-life and I cannot upgrade immediately?

CISA's required action explicitly states that if mitigations are unavailable, organizations should discontinue use of the product. As an interim measure, isolate the instance from the internet, restrict admin-panel access to trusted IPs only, rotate all credentials, and treat migration to a supported version as an urgent project. Document the compensating controls for compliance purposes under BOD 26-04.