CVE-2022-30617: Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
Summary
CVE-2022-30617: Improper Removal of Sensitive Information Before Storage or Transfer in Strapi. Affects strapi versions >= 3.0.0, < 3.6.9. Fixed in 3.6.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Strapi is an open-source headless CMS (Content Management System) that provides a customizable and extensible platform for building APIs. It allows developers to create, manage, and distribute content across different digital channels. Strapi is widely used in web development projects to streamline content management processes and enable efficient content delivery. However, a vulnerability has been identified in Strapi that could lead to the exposure of sensitive information.
Vulnerability Detail
The vulnerability in Strapi allows an authenticated user with access to the admin panel to view private and sensitive data of other admin panel users. This includes information such as email addresses and password reset tokens. The issue arises when a user with lower privileges, such as an 'author' role, has a relationship with content that is accessible to another user with higher privileges, such as an 'editor' or 'super admin'. In such cases, the low-privileged user can view the sensitive details in the JSON response for the content updated by the higher-privileged user. This vulnerability can be exploited to compromise other users' accounts by invoking the password reset workflow. In the worst-case scenario, a low-privileged user could gain access to a 'super admin' account, granting them full control over the Strapi instance and the ability to read, modify, and block access to data and APIs.
How To Fix
Latest published version: 3.6.11 as of 22 Oct 2026
npm install strapi@3.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.9
This is the first release that contains the fix.
npm install strapi@3.6.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected Strapi packages to the fixed versions as soon as possible to mitigate the risk of data exposure.
Conclusion
The vulnerability in Strapi allows an authenticated user to access sensitive information of other admin panel users, potentially leading to unauthorized account access and data compromise. It is crucial to update the affected Strapi packages to the fixed versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for strapi →
FAQ
The vulnerability allows an authenticated user to view sensitive information of other admin panel users, potentially leading to unauthorized access to accounts and data.
Users of Strapi versions 3.0.0 to 3.6.8 and versions 4.0.0-beta.14 and earlier are affected by this vulnerability.
No, this vulnerability requires an authenticated user with access to the Strapi admin panel.
The only known mitigation is to update the affected Strapi packages to the fixed versions.
Yes, the CVSS score for this vulnerability is 8.8 (High severity).
Related vulnerabilities
Recent vulnerabilities recorded for strapi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
