Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-pmxr-ytu7-jkf2
Vulnerability ID VCID-pmxr-ytu7-jkf2
Aliases CVE-2023-37263
GHSA-m284-85mf-cgrc
Summary Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-400 Uncontrolled Resource Consumption
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2023-37263
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2023-37263
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-m284-85mf-cgrc
cvssv3.1 6.8 https://github.com/strapi/strapi
generic_textual MODERATE https://github.com/strapi/strapi
cvssv3.1 6.8 https://github.com/strapi/strapi/releases/tag/v4.12.1
generic_textual MODERATE https://github.com/strapi/strapi/releases/tag/v4.12.1
ssvc Track https://github.com/strapi/strapi/releases/tag/v4.12.1
cvssv3.1 6.8 https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc
cvssv3.1_qr MODERATE https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc
generic_textual MODERATE https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc
ssvc Track https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc
cvssv3.1 6.8 https://nvd.nist.gov/vuln/detail/CVE-2023-37263
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-37263
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-37263
https://nvd.nist.gov/vuln/detail/CVE-2023-37263
GHSA-m284-85mf-cgrc https://github.com/advisories/GHSA-m284-85mf-cgrc
GHSA-m284-85mf-cgrc https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc
v4.12.1 https://github.com/strapi/strapi/releases/tag/v4.12.1
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/strapi/strapi
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/strapi/strapi/releases/tag/v4.12.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-25T14:58:02Z/ Found at https://github.com/strapi/strapi/releases/tag/v4.12.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N Found at https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-25T14:58:02Z/ Found at https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-37263
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.30091
EPSS Score 0.00117
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:24:33.917965+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/37xxx/CVE-2023-37263.json 38.6.0