Strapi Cleartext Storage of Sensitive Information Vulnerability

Exploited in the wild. Listed by CISA on 2026-10-08; known to be used by ransomware.

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Nonecheck to confirm it

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

No ready check is stored for this CVE. Confirm it by hand from the references.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-22894

Use this check only on systems you are authorised to test. Where the data comes from