# CVE-2023-34235: Strapi database filtering bypass leaking sensitive fields

Source: https://junglewise.ai/threats/cve-2023-34235-strapi-database-filtering-bypass-leaking-sensitive-fields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-34235 · Severity: low · CVSS 3.1 · Published 2023-07-25

Strapi is a popular open-source headless CMS used to build and manage APIs for web and mobile applications. A vulnerability in the database filtering layer allows attackers to bypass access controls on private fields (such as admin passwords and reset tokens) by manipulating query prefixes, exposing sensitive user information without authentication.

Technologies: [@strapi/utils (npm)](https://junglewise.ai/threats/technologies/strapi-utils). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-34235 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-34235 being exploited in the wild.

**How severe is CVE-2023-34235?** Low severity, with a CVSS score of 3.1, published 25 July 2023.

**Which products and versions are affected?** @strapi/database (npm) SEMVER:introduced=0,fixed=4.10.8; @strapi/utils (npm) SEMVER:introduced=0,fixed=4.10.8.

**Is there a fix for CVE-2023-34235?** Yes. @strapi/database (npm): upgrade to 4.10.8 or later; @strapi/utils (npm): upgrade to 4.10.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-34235 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-34235?** Check whether you run @strapi/database (npm) or @strapi/utils (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @strapi/database (npm): upgrade to 4.10.8 or later

  ```sh
  npm install @strapi/database@4.10.8
  ```

- @strapi/utils (npm): upgrade to 4.10.8 or later

  ```sh
  npm install @strapi/utils@4.10.8
  ```


## Technical details

The vulnerability exists in Strapi's Knex query builder integration, where filtering protections only apply to fields referenced by their default prefix (e.g., `password`), but not when fields are prefixed with table aliases (e.g., `t1.password`). An unauthenticated attacker can craft malicious API filter parameters using custom table prefixes to bypass the field-level access controls, allowing them to perform prefix-based filtering attacks against joined tables and extract protected data like admin credentials and reset tokens. No authentication is required. The issue was fixed in @strapi/database and @strapi/utils version 4.10.8 and later.

## Affected products

- Strapi @strapi/database <= 4.10.7
- Strapi @strapi/utils <= 4.10.7

## Identifiers

- CVE-2023-34235
- GHSA-9xg4-3qfm-9w8f

## Timeline

- 2023-07-25: disclosed
- 2023-07-25: patched: Fixed in version 4.10.8

## References

- [https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f](https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f)

## Related threats

- [Strapi information disclosure in content-manager relations view](https://junglewise.ai/threats/cve-2023-36472-strapi-information-disclosure-in-content-manager-relations-view)
- [Strapi content-type attribute disclosure via extension](https://junglewise.ai/threats/cve-2023-34093-strapi-content-type-attribute-disclosure-via-extension)