# CVE-2023-36472: Strapi information disclosure in content-manager relations view

Source: https://junglewise.ai/threats/cve-2023-36472-strapi-information-disclosure-in-content-manager-relations-view  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-09-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-36472 · Severity: low · CVSS 3.1 · Published 2023-09-13

Strapi is a headless CMS platform used to manage and deliver content to applications. A vulnerability in the content-manager plugin allows users with limited administrative permissions (Author role with configure view access) to view sensitive fields like password reset tokens that should be private, potentially enabling account takeover of higher-privileged admin accounts.

Technologies: [@strapi/admin (npm)](https://junglewise.ai/threats/technologies/strapi-admin), [@strapi/plugin-content-manager (npm)](https://junglewise.ai/threats/technologies/strapi-plugin-content-manager), [@strapi/utils (npm)](https://junglewise.ai/threats/technologies/strapi-utils), [Strapi Admin](https://junglewise.ai/threats/technologies/admin). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Strapi](https://junglewise.ai/threats/vendors/strapi).

## Quick answers

**Is CVE-2023-36472 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-36472 being exploited in the wild.

**How severe is CVE-2023-36472?** Low severity, with a CVSS score of 3.1, published 13 September 2023.

**Which products and versions are affected?** @strapi/admin (npm) SEMVER:introduced=0,fixed=4.11.7; @strapi/plugin-content-manager (npm) SEMVER:introduced=0,fixed=4.11.7; @strapi/utils (npm) SEMVER:introduced=0,fixed=4.11.7; Strapi Admin < 4.11.7; and 1 more.

**Is there a fix for CVE-2023-36472?** Yes. @strapi/admin (npm): upgrade to 4.11.7 or later; @strapi/plugin-content-manager (npm): upgrade to 4.11.7 or later; @strapi/utils (npm): upgrade to 4.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-36472 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-36472?** Check whether you run @strapi/admin (npm), @strapi/plugin-content-manager (npm), @strapi/utils (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @strapi/admin (npm): upgrade to 4.11.7 or later

  ```sh
  npm install @strapi/admin@4.11.7
  ```

- @strapi/plugin-content-manager (npm): upgrade to 4.11.7 or later

  ```sh
  npm install @strapi/plugin-content-manager@4.11.7
  ```

- @strapi/utils (npm): upgrade to 4.11.7 or later

  ```sh
  npm install @strapi/utils@4.11.7
  ```


## Technical details

The vulnerability exists in the /content-manager/relations endpoint, which fails to filter out or restrict access to private fields when returning relation data. An attacker with Author role permissions and content-manager configure view access can craft requests to view admin user relations and access sensitive fields such as resetPasswordToken. The attack requires specific role configuration and user interaction but results in exposure of authentication tokens. This is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerability that allows privilege escalation by obtaining an admin's password reset token and changing their password. The vulnerability was fixed in version 4.11.7.

## Affected products

- Strapi Admin < 4.11.7
- Strapi Content-Manager Plugin < 4.11.7
- Strapi Utils < 4.11.7

## Identifiers

- CVE-2023-36472
- GHSA-v8gg-4mq2-88q4

## Timeline

- 2023-09-13: disclosed
- 2023-09-13: patched: Version 4.11.7 released with fix

## References

- [https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4](https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4)

## Related threats

- [Strapi insufficient session invalidation during password reset](https://junglewise.ai/threats/cve-2026-22706-strapi-insufficient-session-invalidation-during-password-reset)
- [Strapi server-side request forgery in webhook settings](https://junglewise.ai/threats/cve-2024-52588-strapi-server-side-request-forgery-in-webhook-settings)
- [Strapi Content Manager data disclosure via relations in admin panel](https://junglewise.ai/threats/cve-2024-29181-strapi-content-manager-data-disclosure-via-relations-in-admin)
- [Strapi rate limit bypass in admin login](https://junglewise.ai/threats/cve-2023-38507-strapi-rate-limit-bypass-in-admin-login)
- [Strapi field level permissions bypass in relationship title](https://junglewise.ai/threats/cve-2023-37263-strapi-field-level-permissions-bypass-in-relationship-title)