CVE-2023-22894: Strapi Admin Panel Cleartext Data Exposure (KEV)

CVE-2023-22894 is a cleartext-storage-of-sensitive-information flaw in Strapi before 4.8.0: an attacker with admin-panel access can exploit the query filter on API responses to discover other users' sensitive fields, including password hashes and password-reset tokens for accounts visible to a super admin, and CISA's KEV entry — added 2026-10-08 — notes it can be chained with CVE-2023-22621 for remote code execution.

CVE-2023-22894 is a cleartext storage of sensitive information vulnerability (CWE-312) in Strapi. NVD's description states it "allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter," and that a super-admin-level attacker can discover "the password hash and password reset token of all users," while a lower-privileged admin with user-management permissions can discover sensitive fields for API users (NVD).

NVD's own primary CVSS v3.1 score is 4.9 (medium, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); a CISA-ADP secondary submission scores the same vulnerability higher, 7.2 (high, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) — that 7.2 figure is the CISA-ADP score, not an NVD-confirmed one, and the two differ because the ADP submission credits greater integrity/availability impact from the chained RCE path (NVD).

Strapi's own security-disclosure post confirms CVE-2023-22894 affects versions 3.2.1 up to but not including 4.8.0, provides a log-search regex to detect exploitation attempts (matching filter parameters like email, password or resetPasswordToken), and states that Strapi 3.x reached end-of-life on 2022-12-31 and will not receive a fix — those installs must first migrate to a supported 4.x release and then patch to 4.8.0 or later (Strapi Security Disclosure).

CISA added CVE-2023-22894 to the KEV catalog on 2026-10-08, due date 2026-10-11 under Binding Operational Directive 26-04, notes it "can be chained with CVE-2023-22621 to achieve remote code execution," and lists known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.0411 (90.709th percentile) — lower than most KEV entries on this site, consistent with a flaw that requires existing admin-panel access rather than direct internet exploitation, though still worth prioritizing given the documented chain to RCE (FIRST EPSS).

Any Strapi instance on 3.x or a pre-4.8.0 4.x release should be upgraded immediately — 3.x installs specifically must migrate to a supported 4.x release first — and admin accounts audited for signs of the query-filter exploitation pattern Strapi describes.

• Attackers with admin-panel access can exploit the query filter to discover sensitive user details; super-admin access exposes password hashes and reset tokens for all users. — NVD
• CVSS v3.1 primary NVD score is 4.9 (medium); a CISA-ADP secondary submission scores it 7.2 (high) due to greater credited integrity/availability impact — the 7.2 figure is CISA-ADP, not NVD-confirmed. — NVD
• Affects Strapi 3.2.1 up to but not including 4.8.0; 3.x reached end-of-life 2022-12-31 with no fix; detection regex and upgrade guidance provided. — Strapi Security Disclosure
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-08, due date 2026-10-11, chainable with CVE-2023-22621 for RCE, known ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.0411 (90.709th percentile) as of 2026-10-26. — FIRST EPSS