# CVE-2022-30617: Strapi sensitive information disclosure in admin responses

Source: https://junglewise.ai/threats/cve-2022-30617-strapi-sensitive-information-disclosure-in-admin-responses  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-30617 · Severity: low · CVSS 3.1 · Published 2022-05-20

Strapi is an open-source headless CMS platform used to manage and deliver content to web and mobile applications. An authenticated user with low privileges can view sensitive data (such as password reset tokens and email addresses) of other admin users by examining JSON responses from content they can access. This allows attackers to compromise higher-privileged accounts, including full administrative control of the Strapi instance, enabling data theft, unauthorized modifications, and complete system lockdown.

Technologies: [@strapi/strapi (npm)](https://junglewise.ai/threats/technologies/strapi-strapi), [strapi (npm)](https://junglewise.ai/threats/technologies/strapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-30617 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-30617 being exploited in the wild.

**How severe is CVE-2022-30617?** Low severity, with a CVSS score of 3.1, published 20 May 2022.

**Which products and versions are affected?** @strapi/strapi (npm) SEMVER:introduced=0,fixed=4.0.0-beta.15; strapi (npm) SEMVER:introduced=3.0.0,fixed=3.6.9.

**Is there a fix for CVE-2022-30617?** Yes. @strapi/strapi (npm): upgrade to 4.0.0-beta.15 or later; strapi (npm): upgrade to 3.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-30617 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-30617?** Check whether you run @strapi/strapi (npm) or strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @strapi/strapi (npm): upgrade to 4.0.0-beta.15 or later

  ```sh
  npm install @strapi/strapi@4.0.0-beta.15
  ```

- strapi (npm): upgrade to 3.6.9 or later

  ```sh
  npm install strapi@3.6.9
  ```


## Technical details

The vulnerability is an improper removal of sensitive information (CWE-212) in Strapi's API responses. When a low-privileged authenticated user accesses content (e.g., a blog post), the JSON response includes sensitive user metadata (password reset tokens, email addresses) from related admin accounts (those who created or updated the content). The root cause is insufficient data filtering before serialization. An authenticated attacker can exploit this through direct API calls by accessing any content with relationships to higher-privileged users. No user interaction is required beyond initial authentication. Successful exploitation enables lateral movement and privilege escalation up to super-admin level. Patches are available: strapi <3.6.9 and @strapi/strapi <4.0.0-beta.15 are affected; updates to 3.6.9 or 4.0.0-beta.15+ are required.

## Affected products

- Strapi Strapi 3.0.0 to 3.6.8
- Strapi Strapi 4.0.0-beta.1 to 4.0.0-beta.14

## Identifiers

- CVE-2022-30617
- GHSA-f6fm-r26q-p747

## Timeline

- 2022-05-20: disclosed
- 2022-05-20: patched: Patches available: strapi 3.6.9, @strapi/strapi 4.0.0-beta.15

## References

- [https://github.com/strapi/strapi](https://github.com/strapi/strapi)

## Related threats

- [Strapi administrative account takeover via relational query filtering](https://junglewise.ai/threats/cve-2026-27886-strapi-administrative-account-takeover-via-relational-query)
- [Strapi insufficient session expiration in JWT authentication](https://junglewise.ai/threats/cve-2025-3930-strapi-insufficient-session-expiration-in-jwt-authentication)
- [Strapi Server-Side Request Forgery](https://junglewise.ai/threats/cve-2024-37818-strapi-server-side-request-forgery)
- [Strapi authorization bypass in user registration API](https://junglewise.ai/threats/cve-2023-39345-strapi-authorization-bypass-in-user-registration-api)
- [Strapi content-type attribute disclosure via extension](https://junglewise.ai/threats/cve-2023-34093-strapi-content-type-attribute-disclosure-via-extension)