CISA added Strapi’s user-filter flaw, CVE-2023-22894, to its Known Exploited Vulnerabilities catalog on October 8 and set October 11 as the action date. Strapi sites running affected releases from 3.2.1 up to, but excluding, 4.8.0 can expose private user fields through query filtering. The immediate work for operators is to identify those deployments and preserve their request logs before upgrading.
The larger risk is a chain on older installations. CISA says, “This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.” Strapi’s own disclosure describes how the filter flaw could expose a super administrator’s reset token, letting an attacker take over that account and reach the vulnerable email-template function on versions through 4.5.5. Strapi credits researcher GhostCcamm with discovering and reporting the chain. CISA lists active exploitation of CVE-2023-22894. On each site, inspect request logs and template changes before attributing code execution to this chain.
Private fields leak through filters
A Strapi API response can reveal information about a field even when the field itself stays hidden. The filter lets a requester test values in a private column and infer a match from the response. The CVE Program’s record describes a narrower admin-panel scenario: a super administrator can infer user password hashes and reset tokens; an Editor or Author with access to API users’ names and email addresses can infer private data for those API users, but not for other admin accounts.
Strapi’s investigation found another path. A publicly accessible collection entry created or changed by a super administrator could make the administrator’s details available to the vulnerable filtering logic. That finding explains why its disclosure describes unauthenticated account takeover under the demonstrated conditions, despite the admin-access precondition in the older CVE description. Check public collections as well as admin-panel permissions when scoping exposure.
Reset tokens lead toward code execution
The exposed reset token can be used to seize a super administrator account. On Strapi 4.5.5 and earlier, CVE-2023-22621 also left the users-permissions plugin’s email templates vulnerable to server-side template injection. Strapi says combining the two flaws enables unauthenticated remote code execution. This is a conditional chain: the standalone filter bug concerns private-field disclosure, while the template bug supplies the later code-execution step.
Figure details
The top card reads Private-field filter. Its left arrow leads to Private data inferred; its right arrow leads to Admin reset token. A downward arrow from Admin reset token leads to Template RCE chain.
A patch for the template issue arrived in 4.5.6; the filter issue remained in subsequent 4.x releases before 4.8.0. Strapi’s timeline says 4.8.0 fixed the filter issue, and NVD’s affected range ends just before 4.8.0. Strapi’s summary instead says to update to a release greater than 4.8.0. To follow that explicit vendor upgrade instruction and cover later fixes, choose a supported release newer than 4.8.0.
Search request logs for probes
Strapi says filter exploitation appears in GET parameters that normal request logs capture. Search the Strapi application or upstream HTTP access logs for bracketed filter keys containing email, password, reset_password_token, or resetPasswordToken; the vendor gives this defensive search command:
grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)' $PATH_TO_LOG_FILE
Inspect matching requests in context, especially repeated requests against password or reset-token fields. Strapi says such requests can indicate leaked hashes and tokens and calls for incident response. Preserve the original query strings and correlate them with reset activity, admin sign-ins, and changes to email templates. For the separate template flaw, Strapi identifies PUT requests to /users-permissions/email-templates as a sign that a template changed; compare those templates with known-good versions and look for unexpected code. A template-change request alone is not proof of execution.
Move vulnerable Strapi off old releases
Inventory Strapi application versions and the exposed public collections and admin panel. Upgrade affected 4.x deployments to a supported release newer than 4.8.0, then verify the installed application version on each running instance. Strapi 3.x reached end of support in December 2022; migrate those deployments to a patched, supported branch. Restrict admin-panel access to administrators while the upgrades are scheduled, and follow CISA’s KEV instruction to assess internet exposure and conduct forensic triage where applicable.
A useful final check is a running version beyond 4.8.0 on every inventoried Strapi instance, followed by a review of preserved GET query logs for private-field probes and of email-template changes on installations that ran 4.5.5 or earlier. A quiet log search can miss traffic that an upstream proxy stripped or never retained; confirm which layer kept the query strings before interpreting the result. The upgrade removes the old filter path, while the log review tells you whether the past exposure needs an incident response.