CVE-2021-46440: Insecure password handling vulnerability in Strapi
Summary
CVE-2021-46440: Insecure password handling vulnerability in Strapi. Affects strapi versions < 3.6.9. Fixed in 3.6.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strapi is an open-source headless CMS (Content Management System) that enables developers to build powerful APIs quickly. It provides a flexible and customizable content management solution for websites, mobile applications, and other digital platforms. Strapi allows users to create, manage, and publish content through a user-friendly interface. However, a vulnerability has been discovered in Strapi versions before 3.6.9 and 4.x before 4.1.5 that involves insecure password handling in the DOCUMENTATION plugin component.
Vulnerability Detail
The vulnerability arises from the storage of passwords in a recoverable format within the DOCUMENTATION plugin component of Strapi. This insecure storage allows an attacker to access a victim's HTTP request. By intercepting the request, the attacker can obtain the victim's cookie, base64 decode it, and retrieve the cleartext password. This compromised password can then be used to gain unauthorized access to the victim's account and potentially perform further API attacks. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 3.6.11 as of 22 Oct 2026
npm install strapi@3.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.9
This is the first release that contains the fix.
npm install strapi@3.6.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Strapi to the fixed versions mentioned above to mitigate the risk.
Conclusion
In summary, the insecure password handling vulnerability in Strapi's DOCUMENTATION plugin component can lead to unauthorized access and potential API attacks. It is crucial to update Strapi to the recommended fixed versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for strapi →
FAQ
Strapi is an open-source headless CMS that allows developers to build APIs quickly and manage content efficiently.
The DOCUMENTATION plugin component in Strapi provides functionality for generating API documentation.
The vulnerability allows an attacker to access a victim's HTTP request and retrieve their cleartext password. This compromised password can be used for unauthorized access and further API attacks.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, update Strapi to version 3.6.9 or higher for versions before 4.x, and to version 4.1.5 or higher for versions 4.x.
Related vulnerabilities
Recent vulnerabilities recorded for strapi.
