DeutschShown in its original language — a full translation is planned for a future version.
Strapi: Mehrere Schwachstellen
view advisory published 2026-05-14
Ein Angreifer kann mehrere Schwachstellen in Strapi ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Administratorrechte zu erlangen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
01
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27886US | high7.5 | Exploit | ||
Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering con… | ||||
| CVE-2026-22707US | medium5.4 | — | ||
Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configu… | ||||
| CVE-2026-22706US | medium6.5 | Exploit | ||
Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refr… | ||||
| CVE-2026-22599US | high7.2 | Exploit | ||
Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnera… | ||||
| CVE-2025-64526US | medium5.3 | — | ||
Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit ke… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-3xcq-8mjw-h6mx vom 2026-05-14external
- GitHub Security Advisory GHSA-7mqx-wwh4-f9fw vom 2026-05-14external
- GitHub Security Advisory GHSA-hvp3-26wx-g2w4 vom 2026-05-14external
- GitHub Security Advisory GHSA-pcw7-5633-82vv vom 2026-05-14external
- GitHub Security Advisory GHSA-rjg2-95x7-8qmx vom 2026-05-14external
- WID-SEC-W-2026-1552 - CSAF Versionself
- WID-SEC-2026-1552 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan