Is CVE-2026-22706 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22706 being exploited in the wild.

How severe is CVE-2026-22706?

Medium severity, with a CVSS score of 6.5, published 14 May 2026.

Which products and versions are affected?

@strapi/admin (npm) <= 5.33.2, SEMVER:introduced=0,fixed=5.33.3; @strapi/plugin-users-permissions (npm) <= 5.33.2, SEMVER:introduced=0,fixed=5.33.3; Strapi Admin <= 5.33.2; Strapi Users & Permissions Plugin <= 5.33.2.

Is there a fix for CVE-2026-22706?

Yes. @strapi/admin (npm): upgrade to 5.33.3 or later; @strapi/plugin-users-permissions (npm): upgrade to 5.33.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22706 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-22706?

Check whether you run @strapi/admin (npm), @strapi/plugin-users-permissions (npm), Strapi Admin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22706: Strapi insufficient session invalidation during password reset

Q: Which products and versions are affected?

@strapi/admin (npm) <= 5.33.2, SEMVER:introduced=0,fixed=5.33.3; @strapi/plugin-users-permissions (npm) <= 5.33.2, SEMVER:introduced=0,fixed=5.33.3; Strapi Admin <= 5.33.2; Strapi Users & Permissions Plugin <= 5.33.2.

Q: Is there a fix for CVE-2026-22706?

Yes. @strapi/admin (npm): upgrade to 5.33.3 or later; @strapi/plugin-users-permissions (npm): upgrade to 5.33.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-22706 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-22706?

Check whether you run @strapi/admin (npm), @strapi/plugin-users-permissions (npm), Strapi Admin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22706 · Severity: medium · CVSS 6.5 · Published 2026-05-14

Strapi, a popular content management system, failed to properly terminate all active user sessions when a password was changed or reset. This means that if an attacker had already gained unauthorized access to an account, they could remain logged in even after the legitimate owner changed their password to lock them out. This flaw undermines password resets as a security measure, potentially allowing unauthorized access to persist for up to 30 days.

Technologies: @strapi/admin (npm), @strapi/plugin-users-permissions (npm), Strapi Admin, Strapi Users & Permissions Plugin. Vendors: npm, Strapi.

Quick answers

Is CVE-2026-22706 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22706 being exploited in the wild.
How severe is CVE-2026-22706?: Medium severity, with a CVSS score of 6.5, published 14 May 2026.
Which products and versions are affected?: @strapi/admin (npm) <= 5.33.2, SEMVER:introduced=0,fixed=5.33.3; @strapi/plugin-users-permissions (npm) <= 5.33.2, SEMVER:introduced=0,fixed=5.33.3; Strapi Admin <= 5.33.2; Strapi Users & Permissions Plugin <= 5.33.2.
Is there a fix for CVE-2026-22706?: Yes. @strapi/admin (npm): upgrade to 5.33.3 or later; @strapi/plugin-users-permissions (npm): upgrade to 5.33.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22706 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-22706?: Check whether you run @strapi/admin (npm), @strapi/plugin-users-permissions (npm), Strapi Admin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@strapi/admin (npm): upgrade to 5.33.3 or later
```
npm install @strapi/admin@5.33.3
```
@strapi/plugin-users-permissions (npm): upgrade to 5.33.3 or later
```
npm install @strapi/plugin-users-permissions@5.33.3
```

Technical details

A vulnerability in Strapi's authentication logic exists where the refresh-token invalidation step in the 'users-permissions' and 'admin' controllers is conditionally tied to a caller-supplied 'deviceId'. If a password reset or change request is made without this identifier, existing refresh tokens remain valid in the database. An attacker possessing a valid refresh token can continue to generate new access tokens for the duration of the refresh token's lifespan (defaulting to 30 days), even after the user's credentials have been rotated. This issue is classified as CWE-613 (Insufficient Session Expiration). Version 5.33.3 addresses this by ensuring all refresh tokens associated with a user are invalidated upon password modification, regardless of the presence of a device ID.

Affected products

Strapi Strapi < 5.33.3
Strapi @strapi/admin <= 5.33.2
Strapi @strapi/plugin-users-permissions <= 5.33.2

Identifiers

CVE-2026-22706
GHSA-hvp3-26wx-g2w4

Timeline

2026-05-13: advisory: GitHub advisory published by maintainers
2026-05-14: disclosed: CVE published to NVD

References

https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.