CVE-2019-18818: Privilege Escalation in Strapi
Summary
CVE-2019-18818: Strapi allows unauthenticated attacker to reset admin password without valid reset token. Affects strapi versions < 3.0.0-beta.17.5. Fixed in 3.0.0-beta.17.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strapi is an open-source headless CMS (Content Management System) that provides developers with a set of tools to build, deploy, and manage APIs. It allows users to create and manage content easily. However, versions of Strapi prior to 3.0.0-beta.17.5 are vulnerable to a privilege escalation vulnerability.
Vulnerability Detail
The vulnerability in Strapi allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token. This means that an attacker can gain unauthorized access to an admin account and potentially perform malicious actions with elevated privileges. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 3.6.11 as of 22 Oct 2026
npm install strapi@3.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0-beta.17.5
This is the first release that contains the fix.
npm install strapi@3.0.0-beta.17.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The privilege escalation vulnerability in Strapi allows an unauthenticated attacker to reset an admin's password without a valid reset token. To mitigate this vulnerability, it is crucial to upgrade to version 3.0.0-beta.17.5 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for strapi →
FAQ
The vulnerability allows an attacker to reset an admin's password without a valid reset token, leading to unauthorized access and potential misuse of the admin account.
You can check the version of Strapi installed in your project by running the command 'strapi -v' in your terminal. If the version is lower than 3.0.0-beta.17.5, your installation is vulnerable.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version.
There is no evidence of this vulnerability being exploited in the wild at the time of this advisory. However, it is crucial to apply the fix as soon as possible to prevent any potential attacks.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-6xc2-mj39-q599/GHSA-6xc2-mj39-q599.json
Related vulnerabilities
Recent vulnerabilities recorded for strapi.
