CVE-2023-22894

Cleartext Storage of Sensitive Information in Strapi. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 8 October 2026.

Product: Strapi
Added to CISA's catalog: 8 October 2026
Federal fix-by date: 11 October 2026
Ransomware: No known use in ransomware campaigns
Vendor advisories: strapi.io/blog/security-disclosure-of-vulnerabilities-cve
github.com/strapi/strapi/releases
Sources: CISA’s catalog, NVD entry

CISA’s description.

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.