CVE-2020-27664: Authorization bypass in Strapi
Summary
CVE-2020-27664: Authorization bypass in Strapi. Affects strapi versions < 3.2.5. Fixed in 3.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strapi is an open-source headless CMS (Content Management System) that enables developers to build powerful APIs quickly. It provides a flexible and customizable content management platform for creating and managing digital content. Strapi is widely used in web development projects to streamline content creation and delivery processes. However, a critical vulnerability has been discovered in Strapi versions prior to 3.2.5.
Vulnerability Detail
The vulnerability, identified as CVE-2020-27664, allows for an authorization bypass in Strapi. Specifically, the 'admin/src/containers/InputModalStepperProvider/index.js' file in Strapi contains unwanted '/proxy?url=' functionality. This functionality can be exploited by an attacker to bypass authorization mechanisms and gain unauthorized access to sensitive resources and functionalities within the Strapi application. The vulnerability has a CVSS score of 9.8, indicating its high severity.
How To Fix
Latest published version: 3.6.11 as of 22 Oct 2026
npm install strapi@3.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.5
This is the first release that contains the fix.
npm install strapi@3.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually remove or disable the '/proxy?url=' functionality in the 'admin/src/containers/InputModalStepperProvider/index.js' file. This can be achieved by modifying the code to remove any references to the '/proxy?url=' functionality. However, this workaround is not recommended as it may introduce other issues and is not a comprehensive solution. Upgrading to the latest version of Strapi is the recommended approach.
Conclusion
In conclusion, CVE-2020-27664 is a critical vulnerability in Strapi that allows for an authorization bypass. It is crucial for developers using Strapi to upgrade to version 3.2.5 or later to mitigate this vulnerability. The Strapi project provides detailed instructions on how to perform the upgrade. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for strapi →
FAQ
Strapi is an open-source headless CMS (Content Management System) that provides a flexible and customizable platform for creating and managing digital content.
The vulnerability allows for an authorization bypass, enabling attackers to gain unauthorized access to sensitive resources and functionalities within the Strapi application.
The CVSS score of this vulnerability is 9.8, indicating its high severity.
To fix this vulnerability, it is recommended to upgrade Strapi to version 3.2.5 or later. Follow the upgrade instructions provided by the Strapi project to ensure a smooth transition.
A workaround involves manually removing or disabling the '/proxy?url=' functionality in the affected file. However, upgrading to the latest version of Strapi is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for strapi.
