# Strapi vulnerabilities Source: https://junglewise.ai/threats/vendors/strapi Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/strapi.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Strapi: 0 in the last 7 days and 4 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-118172, was published on 27 October 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 4 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 4 - All time: 17 (2 critical, 1 exploited in the wild) ## About Strapi Headless CMS and API platform for building and managing content with a web-based interface. ## Latest Strapi vulnerabilities - [CVE-2026-118172: Strapi Core webhook semi-blind SSRF via redirect](https://junglewise.ai/threats/cve-2026-118172-the-strapi-strapi-core-admin-webhook-runner-package-is) (info, published 27 Oct 2026) - [CVE-2026-118171: Strapi content-manager missing content-scope authorization in preview URL](https://junglewise.ai/threats/cve-2026-118171-the-strapi-content-manager-package-is-missing-content-scope) (info, published 27 Oct 2026) - [CVE-2026-118170: Strapi review-workflows broken access control in update operations](https://junglewise.ai/threats/cve-2026-118170-the-strapi-review-workflows-package-is-vulnerable-to-a-broken) (info, published 27 Oct 2026) - [CVE-2026-108114: Strapi improper authorization in API token permission reconciliation](https://junglewise.ai/threats/cve-2026-108114-strapi-5-47-0-through-5-57-0-contains-an-improper-authorization) (medium, CVSS 4.3, published 10 Oct 2026) - [CVE-2026-22707: Strapi Upload plugin MIME validation bypass in Content API](https://junglewise.ai/threats/cve-2026-22707-strapi-upload-plugin-mime-validation-bypass-in-content-api) (medium, CVSS 5.4, published 14 May 2026) - [CVE-2026-22706: Strapi insufficient session invalidation during password reset](https://junglewise.ai/threats/cve-2026-22706-strapi-insufficient-session-invalidation-during-password-reset) (medium, CVSS 6.5, published 14 May 2026) - [CVE-2026-22599: Strapi SQL injection in Content-Type Builder API](https://junglewise.ai/threats/cve-2026-22599-strapi-sql-injection-in-content-type-builder-api) (critical, CVSS 7.2, published 14 May 2026) - [CVE-2025-64526: Strapi users-permissions plugin rate limit bypass in auth routes](https://junglewise.ai/threats/cve-2025-64526-strapi-users-permissions-plugin-rate-limit-bypass-in-auth-routes) (medium, CVSS 5.3, published 14 May 2026) - [CVE-2024-52588: Strapi server-side request forgery in webhook settings](https://junglewise.ai/threats/cve-2024-52588-strapi-server-side-request-forgery-in-webhook-settings) (low, CVSS 3.1, published 27 May 2025) - [CVE-2024-34065: Strapi users-permissions open redirect and token leakage](https://junglewise.ai/threats/cve-2024-34065-strapi-users-permissions-open-redirect-and-token-leakage) (low, CVSS 3.1, published 12 Jun 2024) - [CVE-2023-39345: Strapi authorization bypass in user registration API](https://junglewise.ai/threats/cve-2023-39345-strapi-authorization-bypass-in-user-registration-api) (low, CVSS 3.1, published 3 Nov 2023) - [CVE-2023-38507: Strapi rate limit bypass in admin login](https://junglewise.ai/threats/cve-2023-38507-strapi-rate-limit-bypass-in-admin-login) (low, CVSS 3.1, published 13 Sep 2023) - [CVE-2023-36472: Strapi information disclosure in content-manager relations view](https://junglewise.ai/threats/cve-2023-36472-strapi-information-disclosure-in-content-manager-relations-view) (low, CVSS 3.1, published 13 Sep 2023) - [CVE-2023-22621: Strapi Users-Permissions plugin RCE via Server-Side Template Injection](https://junglewise.ai/threats/cve-2023-22621-strapi-users-permissions-plugin-rce-via-server-side-template) (low, CVSS 3.1, published 19 Apr 2023) - [CVE-2023-22894: Strapi information disclosure via private field filtering](https://junglewise.ai/threats/cve-2023-22894-strapi-information-disclosure-via-private-field-filtering) (critical, exploited in the wild, CVSS 3.1, published 19 Apr 2023) - [CVE-2023-22893: Strapi OAuth token verification bypass in AWS Cognito](https://junglewise.ai/threats/cve-2023-22893-strapi-oauth-token-verification-bypass-in-aws-cognito) (info, CVSS 6.5, published 19 Apr 2023) - [Strapi @strapi/plugin-users-permissions authentication bypass in AWS Cognito](https://junglewise.ai/threats/strapi-strapi-plugin-users-permissions-authentication-bypass-in-aws-ea8259b6) (low, CVSS 3.1, published 18 Apr 2023) ## Most severe Strapi vulnerabilities - [CVE-2023-22894: Strapi information disclosure via private field filtering](https://junglewise.ai/threats/cve-2023-22894-strapi-information-disclosure-via-private-field-filtering) (critical, exploited in the wild, CVSS 3.1, published 19 Apr 2023) - [CVE-2026-22599: Strapi SQL injection in Content-Type Builder API](https://junglewise.ai/threats/cve-2026-22599-strapi-sql-injection-in-content-type-builder-api) (critical, CVSS 7.2, published 14 May 2026) - [CVE-2026-22706: Strapi insufficient session invalidation during password reset](https://junglewise.ai/threats/cve-2026-22706-strapi-insufficient-session-invalidation-during-password-reset) (medium, CVSS 6.5, published 14 May 2026) - [CVE-2026-22707: Strapi Upload plugin MIME validation bypass in Content API](https://junglewise.ai/threats/cve-2026-22707-strapi-upload-plugin-mime-validation-bypass-in-content-api) (medium, CVSS 5.4, published 14 May 2026) - [CVE-2025-64526: Strapi users-permissions plugin rate limit bypass in auth routes](https://junglewise.ai/threats/cve-2025-64526-strapi-users-permissions-plugin-rate-limit-bypass-in-auth-routes) (medium, CVSS 5.3, published 14 May 2026) - [CVE-2026-108114: Strapi improper authorization in API token permission reconciliation](https://junglewise.ai/threats/cve-2026-108114-strapi-5-47-0-through-5-57-0-contains-an-improper-authorization) (medium, CVSS 4.3, published 10 Oct 2026) - [CVE-2024-34065: Strapi users-permissions open redirect and token leakage](https://junglewise.ai/threats/cve-2024-34065-strapi-users-permissions-open-redirect-and-token-leakage) (low, CVSS 3.1, published 12 Jun 2024) - [CVE-2023-36472: Strapi information disclosure in content-manager relations view](https://junglewise.ai/threats/cve-2023-36472-strapi-information-disclosure-in-content-manager-relations-view) (low, CVSS 3.1, published 13 Sep 2023) - [CVE-2023-39345: Strapi authorization bypass in user registration API](https://junglewise.ai/threats/cve-2023-39345-strapi-authorization-bypass-in-user-registration-api) (low, CVSS 3.1, published 3 Nov 2023) - [CVE-2024-52588: Strapi server-side request forgery in webhook settings](https://junglewise.ai/threats/cve-2024-52588-strapi-server-side-request-forgery-in-webhook-settings) (low, CVSS 3.1, published 27 May 2025) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up 200% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Strapi technologies - [Strapi Admin](https://junglewise.ai/threats/technologies/admin): 7 vulnerabilities - [Strapi Users Permissions Plugin](https://junglewise.ai/threats/technologies/users-permissions-plugin): 6 vulnerabilities - [Strapi Plugin-Users-Permissions](https://junglewise.ai/threats/technologies/plugin-users-permissions): 3 vulnerabilities - [Strapi](https://junglewise.ai/threats/technologies/strapi-strapi-1): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Strapi vulnerabilities", https://junglewise.ai/threats/vendors/strapi, 10 November 2026.