CVE-2022-30618: Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
Summary
CVE-2022-30618: Improper Removal of Sensitive Information Before Storage or Transfer in Strapi. Affects strapi versions >= 3.0.0, < 3.6.9. Fixed in 3.6.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strapi is an open-source headless CMS (Content Management System) that provides a flexible and customizable way to manage content and build APIs. It allows users to create and manage content types, define relationships between them, and expose APIs for accessing the content. Strapi is widely used in web development projects to streamline content management and API development processes.
Vulnerability Detail
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). This vulnerability arises due to improper removal of sensitive information before storage or transfer. The JSON response within the admin panel may leak these details, enabling a user to compromise API user accounts and potentially gain unauthorized access to high-privileged accounts. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 3.6.11 as of 22 Oct 2026
npm install strapi@3.6.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.9
This is the first release that contains the fix.
npm install strapi@3.6.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the fixed versions of the affected packages.
Conclusion
In conclusion, the vulnerability in Strapi allows authenticated users to access sensitive information of API users, potentially compromising their accounts. It is crucial to upgrade to the fixed versions of the affected packages to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for strapi →
FAQ
Strapi is an open-source headless CMS that allows users to create and manage content types, define relationships between them, and expose APIs for accessing the content.
This vulnerability allows authenticated users with access to the Strapi admin panel to view private and sensitive data of API users, potentially compromising their accounts and gaining unauthorized access to high-privileged accounts.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the affected packages (strapi version 3.6.9 or later, @strapi/strapi version 4.1.9 or later).
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by upgrading to the fixed versions of the affected packages.
Related vulnerabilities
Recent vulnerabilities recorded for strapi.
