{"url":"http://public2.vulnerablecode.io/api/packages/622910?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@4.1.2","type":"npm","namespace":"@strapi","name":"plugin-users-permissions","version":"4.1.2","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"5.45.0","latest_non_vulnerable_version":"5.45.0","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/139652?format=json","vulnerability_id":"VCID-9ms4-72fn-nqf8","summary":"strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-39345","reference_id":"","reference_type":"","scores":[{"value":"0.00079","scoring_system":"epss","scoring_elements":"0.23475","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-39345"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39345","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39345"},{"reference_url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023"},{"reference_url":"https://github.com/advisories/GHSA-gc7p-j5xm-xxh2","reference_id":"GHSA-gc7p-j5xm-xxh2","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-gc7p-j5xm-xxh2"},{"reference_url":"https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2","reference_id":"GHSA-gc7p-j5xm-xxh2","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-04T19:26:27Z/"}],"url":"https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/381187?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@4.13.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jsc3-u2up-ebbj"},{"vulnerability":"VCID-th7e-fn9a-6ygf"},{"vulnerability":"VCID-y2hh-5rqc-pfd1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@4.13.1"}],"aliases":["CVE-2023-39345","GHSA-gc7p-j5xm-xxh2"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9ms4-72fn-nqf8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/149468?format=json","vulnerability_id":"VCID-gk75-qk8k-7fab","summary":"Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22893","reference_id":"","reference_type":"","scores":[{"value":"0.50773","scoring_system":"epss","scoring_elements":"0.97918","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22893"},{"reference_url":"https://github.com/strapi/strapi/blob/v4.5.6/packages/plugins/users-permissions/server/services/providers-registry.js","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/blob/v4.5.6/packages/plugins/users-permissions/server/services/providers-registry.js"},{"reference_url":"https://github.com/strapi/strapi/commit/46f8f98378338f18b5c6139d0157a8f71bf4de83","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/commit/46f8f98378338f18b5c6139d0157a8f71bf4de83"},{"reference_url":"https://github.com/strapi/strapi/commit/8bbbd7383a20bb7cb163c8b462baffee559e994f","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/commit/8bbbd7383a20bb7cb163c8b462baffee559e994f"},{"reference_url":"https://github.com/strapi/strapi/commit/eeab43b57707d7ef275076d27be6eabc72bd71a7","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/commit/eeab43b57707d7ef275076d27be6eabc72bd71a7"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22893","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22893"},{"reference_url":"https://www.ghostccamm.com/blog/multi_strapi_vulns","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.ghostccamm.com/blog/multi_strapi_vulns"},{"reference_url":"https://github.com/advisories/GHSA-583x-23h9-f5w7","reference_id":"GHSA-583x-23h9-f5w7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-583x-23h9-f5w7"},{"reference_url":"https://www.ghostccamm.com/blog/multi_strapi_vulns/","reference_id":"multi_strapi_vulns","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-05T16:39:39Z/"}],"url":"https://www.ghostccamm.com/blog/multi_strapi_vulns/"},{"reference_url":"https://github.com/strapi/strapi/releases","reference_id":"releases","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-05T16:39:39Z/"}],"url":"https://github.com/strapi/strapi/releases"},{"reference_url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve","reference_id":"security-disclosure-of-vulnerabilities-cve","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-05T16:39:39Z/"}],"url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/379463?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@4.6.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-9ms4-72fn-nqf8"},{"vulnerability":"VCID-jsc3-u2up-ebbj"},{"vulnerability":"VCID-kvea-g79j-kyge"},{"vulnerability":"VCID-th7e-fn9a-6ygf"},{"vulnerability":"VCID-y2hh-5rqc-pfd1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@4.6.0"}],"aliases":["CVE-2023-22893","GHSA-583x-23h9-f5w7"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gk75-qk8k-7fab"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/90362?format=json","vulnerability_id":"VCID-jsc3-u2up-ebbj","summary":"Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on routes whose body schema does not contain an `email` field (`/auth/local`, `/auth/reset-password`, `/auth/change-password`). An unauthenticated attacker could include an arbitrary `email` value in the request body to obtain a fresh rate-limit key per request, effectively bypassing per-IP throttling on those routes and enabling high-volume credential brute-force, password-reset code brute-force, and credential-stuffing attempts. The rate-limit key was constructed as `${userIdentifier}:${requestPath}:${ctx.request.ip}`, where `userIdentifier = ctx.request.body.email`. On routes that legitimately use email as their identifier (e.g. `/auth/forgot-password`, `/auth/local/register`), this scoping is correct. On routes that use a different identifier (`identifier` for login, `code` for password reset, `currentPassword` for password change), the email field was not part of the route contract, but the middleware still incorporated it into the key, allowing a caller to rotate the value and obtain a unique key on every request. The patch in version 5.45.0 maintains an allow-list of routes that legitimately key on the email field and excludes that key component on every other route the middleware is mounted on. OAuth callback paths (`/connect/*`) are treated identifier-less. On routes outside the allow-list, the middleware now falls back to a fixed identifier-less key, ensuring per-IP throttling remains effective even when the request body is attacker-controlled.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64526","reference_id":"","reference_type":"","scores":[{"value":"0.0001","scoring_system":"epss","scoring_elements":"0.01247","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64526"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64526","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64526"},{"reference_url":"https://github.com/strapi/strapi/pull/24818","reference_id":"24818","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-16T00:48:16Z/"}],"url":"https://github.com/strapi/strapi/pull/24818"},{"reference_url":"https://github.com/strapi/strapi/commit/5e0d243cba9830e6f791de6a94798bcde51468db","reference_id":"5e0d243cba9830e6f791de6a94798bcde51468db","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-16T00:48:16Z/"}],"url":"https://github.com/strapi/strapi/commit/5e0d243cba9830e6f791de6a94798bcde51468db"},{"reference_url":"https://github.com/advisories/GHSA-7mqx-wwh4-f9fw","reference_id":"GHSA-7mqx-wwh4-f9fw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7mqx-wwh4-f9fw"},{"reference_url":"https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw","reference_id":"GHSA-7mqx-wwh4-f9fw","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-16T00:48:16Z/"}],"url":"https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw"},{"reference_url":"https://github.com/strapi/strapi/releases/tag/v5.45.0","reference_id":"v5.45.0","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-05-16T00:48:16Z/"}],"url":"https://github.com/strapi/strapi/releases/tag/v5.45.0"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/375404?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@5.45.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@5.45.0"}],"aliases":["CVE-2025-64526","GHSA-7mqx-wwh4-f9fw"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jsc3-u2up-ebbj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/132220?format=json","vulnerability_id":"VCID-kvea-g79j-kyge","summary":"Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38507","reference_id":"","reference_type":"","scores":[{"value":"0.00319","scoring_system":"epss","scoring_elements":"0.55404","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38507"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38507","reference_id":"","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38507"},{"reference_url":"https://github.com/advisories/GHSA-24q2-59hm-rh9r","reference_id":"GHSA-24q2-59hm-rh9r","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-24q2-59hm-rh9r"},{"reference_url":"https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r","reference_id":"GHSA-24q2-59hm-rh9r","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-25T18:05:45Z/"}],"url":"https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r"},{"reference_url":"https://github.com/strapi/strapi/blob/32d68f1f5677ed9a9a505b718c182c0a3f885426/packages/core/admin/server/middlewares/rateLimit.js#L31","reference_id":"rateLimit.js#L31","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-25T18:05:45Z/"}],"url":"https://github.com/strapi/strapi/blob/32d68f1f5677ed9a9a505b718c182c0a3f885426/packages/core/admin/server/middlewares/rateLimit.js#L31"},{"reference_url":"https://github.com/strapi/strapi/releases/tag/v4.12.1","reference_id":"v4.12.1","reference_type":"","scores":[{"value":"7.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-25T18:05:45Z/"}],"url":"https://github.com/strapi/strapi/releases/tag/v4.12.1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/379815?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@4.12.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-9ms4-72fn-nqf8"},{"vulnerability":"VCID-jsc3-u2up-ebbj"},{"vulnerability":"VCID-th7e-fn9a-6ygf"},{"vulnerability":"VCID-y2hh-5rqc-pfd1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@4.12.1"}],"aliases":["CVE-2023-38507","GHSA-24q2-59hm-rh9r"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kvea-g79j-kyge"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/149612?format=json","vulnerability_id":"VCID-t1hu-xbpy-jqgq","summary":"Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22621","reference_id":"","reference_type":"","scores":[{"value":"0.91021","scoring_system":"epss","scoring_elements":"0.99655","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-22621"},{"reference_url":"https://github.com/strapi/strapi/commit/921d30961d6ba96cc098f2aea197350a49f990bd","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/commit/921d30961d6ba96cc098f2aea197350a49f990bd"},{"reference_url":"https://github.com/strapi/strapi/pull/15385","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/pull/15385"},{"reference_url":"https://github.com/strapi/strapi/releases/tag/v4.5.6","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/releases/tag/v4.5.6"},{"reference_url":"https://github.com/strapi/strapi/security/advisories/GHSA-2h87-4q2w-v4hf","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/security/advisories/GHSA-2h87-4q2w-v4hf"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22621","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22621"},{"reference_url":"https://www.ghostccamm.com/blog/multi_strapi_vulns","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.ghostccamm.com/blog/multi_strapi_vulns"},{"reference_url":"https://github.com/advisories/GHSA-2h87-4q2w-v4hf","reference_id":"GHSA-2h87-4q2w-v4hf","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2h87-4q2w-v4hf"},{"reference_url":"https://www.ghostccamm.com/blog/multi_strapi_vulns/","reference_id":"multi_strapi_vulns","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-05T16:46:02Z/"}],"url":"https://www.ghostccamm.com/blog/multi_strapi_vulns/"},{"reference_url":"https://github.com/strapi/strapi/releases","reference_id":"releases","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-05T16:46:02Z/"}],"url":"https://github.com/strapi/strapi/releases"},{"reference_url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve","reference_id":"security-disclosure-of-vulnerabilities-cve","reference_type":"","scores":[{"value":"10","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-05T16:46:02Z/"}],"url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/379590?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@4.5.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-9ms4-72fn-nqf8"},{"vulnerability":"VCID-gk75-qk8k-7fab"},{"vulnerability":"VCID-jsc3-u2up-ebbj"},{"vulnerability":"VCID-kvea-g79j-kyge"},{"vulnerability":"VCID-th7e-fn9a-6ygf"},{"vulnerability":"VCID-w43j-frj3-tbf3"},{"vulnerability":"VCID-y2hh-5rqc-pfd1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@4.5.6"}],"aliases":["CVE-2023-22621","GHSA-2h87-4q2w-v4hf"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t1hu-xbpy-jqgq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/83593?format=json","vulnerability_id":"VCID-th7e-fn9a-6ygf","summary":"Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure. The patch in version 5.33.3 invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22706","reference_id":"","reference_type":"","scores":[{"value":"0.00063","scoring_system":"epss","scoring_elements":"0.19712","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22706"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22706","reference_id":"","reference_type":"","scores":[{"value":"2.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22706"},{"reference_url":"https://github.com/advisories/GHSA-hvp3-26wx-g2w4","reference_id":"GHSA-hvp3-26wx-g2w4","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hvp3-26wx-g2w4"},{"reference_url":"https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4","reference_id":"GHSA-hvp3-26wx-g2w4","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"2.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-15T14:50:52Z/"}],"url":"https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/375669?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@5.33.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jsc3-u2up-ebbj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@5.33.3"}],"aliases":["CVE-2026-22706","GHSA-hvp3-26wx-g2w4"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-th7e-fn9a-6ygf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/360854?format=json","vulnerability_id":"VCID-w43j-frj3-tbf3","summary":"Authentication Bypass in @strapi/plugin-users-permissions\n### Summary\n\nStrapi through 4.5.6 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication.\n\n### Details\n\nStrapi through 4.5.6 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.\n\n### IoC\n\nReviewing of application logs is recommended to detect any suspicious activity. Running the following regex pattern will extract all ID tokens sent to `/api/auth/cognito/callback`.\n\n`/\\/api\\/auth\\/cognito\\/callback\\?[\\s\\S]*id_token=\\s*([\\S]*)/`\n\nOnce you have a list of the ID tokens, you will need to verify each token using the public key file for your AWS Cognito user pool that you can download from `https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json`. If there are any JWT tokens that cannot be verified using the correct public key, then you need to inspect the JWT body and see if it contains the `email` and `cognito:username` claims (example below).\n\n```json\n{\n  \"cognito:username\": \"auth-bypass-example\",\n  \"email\": \"user@example.com\"\n}\n```\n\nIf there are any JWTs that have this body, verify when the account with the email address was created. If the account was created earlier than the request to `/api/auth/cognito/callback` with the invalid JWT token, then you need to contact the user to inform them their account has been breached!\n\nAfter upgrading to Strapi v4.6.0 or greater you will need to reconfigure your AWS Cognito provider to include the JWKS URL for it to work properly. If you do not reconfigure your provider you will receive an error message when attempting to login.\n\n\n### Impact\n\nAny Strapi user using the users-permissions AWS Cognito provider before 4.6.0","references":[{"reference_url":"https://github.com/strapi/strapi/commit/d0edd25ceb49d275d710bf8d59999a2c07072893","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/commit/d0edd25ceb49d275d710bf8d59999a2c07072893"},{"reference_url":"https://github.com/strapi/strapi/pull/15382","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/pull/15382"},{"reference_url":"https://github.com/strapi/strapi/releases/tag/v4.6.0","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/releases/tag/v4.6.0"},{"reference_url":"https://github.com/strapi/strapi/security/advisories/GHSA-xv3q-jrmm-4fxv","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/security/advisories/GHSA-xv3q-jrmm-4fxv"},{"reference_url":"https://github.com/advisories/GHSA-xv3q-jrmm-4fxv","reference_id":"GHSA-xv3q-jrmm-4fxv","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xv3q-jrmm-4fxv"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/379463?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@4.6.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-9ms4-72fn-nqf8"},{"vulnerability":"VCID-jsc3-u2up-ebbj"},{"vulnerability":"VCID-kvea-g79j-kyge"},{"vulnerability":"VCID-th7e-fn9a-6ygf"},{"vulnerability":"VCID-y2hh-5rqc-pfd1"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@4.6.0"}],"aliases":["GHSA-xv3q-jrmm-4fxv","GMS-2023-1157"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w43j-frj3-tbf3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/49719?format=json","vulnerability_id":"VCID-y2hh-5rqc-pfd1","summary":"Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd party token and the bypass authentication of Strapi apps. Users should upgrade @strapi/plugin-users-permissions to version 4.24.2 to receive a patch.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-34065","reference_id":"","reference_type":"","scores":[{"value":"0.00796","scoring_system":"epss","scoring_elements":"0.74423","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-34065"},{"reference_url":"https://github.com/strapi/strapi/commit/9c79921d22142a5de77ea26151550a14e4b12669","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/commit/9c79921d22142a5de77ea26151550a14e4b12669"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34065","reference_id":"CVE-2024-34065","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34065"},{"reference_url":"https://github.com/advisories/GHSA-wrvh-rcmr-9qfc","reference_id":"GHSA-wrvh-rcmr-9qfc","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wrvh-rcmr-9qfc"},{"reference_url":"https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc","reference_id":"GHSA-wrvh-rcmr-9qfc","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-12T16:08:21Z/"}],"url":"https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32181?format=json","purl":"pkg:npm/%40strapi/plugin-users-permissions@4.24.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-jsc3-u2up-ebbj"},{"vulnerability":"VCID-th7e-fn9a-6ygf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@4.24.2"}],"aliases":["CVE-2024-34065","GHSA-wrvh-rcmr-9qfc"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y2hh-5rqc-pfd1"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/plugin-users-permissions@4.1.2"}