Strapi Cleartext Storage of Sensitive Information Vulnerability

Strapi Strapi

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11).

First seen: 8 Oct 2026
Last update: 8 Oct 2026, 12:00 UTC
Identifiers: CVE-2023-22894
CVSS: 7.2
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Strapi Cleartext Storage of Sensitive Information Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Strapi Strapi
Ids: CVE-2023-22894

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. Added to CISA KEV on 2026-10-08 (federal deadline 2026-10-11).

## Steps
1. Search the repo, its CI and infra config for Strapi Strapi. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2023-22894") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/strapi/strapi/releases https://nvd.nist.gov/vuln/detail/CVE-2023-22894
https://pwned.coffee/i/strapi-cleartext-storage-of-sensitive-information-vulner-cve-2023-22894

Sources

Totalone hot coffee