Strapi Support & Health

GHSA-4phg-hpqm-c3j4 CVSS_V3

Strapi mishandles hidden attributes within admin API responses

Published: 2022-09-28 Fixed in: 3.6.10

GHSA-4r8w-3jww-m2rp CVSS_V4

Strapi is vulnerable to Insufficient Session Expiration

Published: 2025-10-16 Fixed in: 5.24.1

GHSA-4vm8-j95f-j6v5 CVSS_V3

Strapi 4.1.12 Cross-site Scripting via crafted file

Published: 2022-07-14 No fix available

GHSA-85vg-grr5-pw42 CVSS_V3

Insecure password handling vulnerability in Strapi

Published: 2022-05-04 Fixed in: 3.6.9

GHSA-chmr-rg2f-9jmf CVSS_V3

Making all attributes on a content-type public without noticing it

Published: 2023-07-25 Fixed in: 4.10.8

GHSA-f6fm-r26q-p747 CVSS_V3

Improper Removal of Sensitive Information Before Storage or Transfer in Strapi

Published: 2022-05-20 Fixed in: 3.6.9

GHSA-gc7p-j5xm-xxh2 CVSS_V3

Unauthorized Access to Private Fields in User Registration API

Published: 2023-11-03 Fixed in: 4.13.1

GHSA-jjqf-j4w7-92w8 CVSS_V3

Strapi leaking sensitive user information by filtering on private fields

Published: 2023-04-19 Fixed in: 4.8.0

GHSA-p9ff-j98v-p435 CVSS_V3

Strapi Server-Side Request Forgery (SSRF)

Published: 2024-06-20 No fix available

GHSA-rjg2-95x7-8qmx CVSS_V4

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

Published: 2026-05-14 Fixed in: 5.37.0

Strapi