AI analysis
Claude Opus · 7 Nov 2026, 10:19 CET
Strapi admin query filter lets privileged users infer password hashes and reset tokens
Strapi versions from 3.2.1 up to but not including 4.8.0 let admin panel users infer sensitive user data, including password hashes and reset tokens, through query filters. CISA lists it as exploited. Upgrade, rotate tokens and review admin access.
In plain terms
Strapi is a headless content management system, which means it stores and serves website or app content through an API (an interface other programs use to request data). In affected versions, someone who can already log in to the Strapi admin panel can use the search and filter feature to work out private details about other users. They do this by filtering on hidden fields and watching how the results change, without the system ever displaying those fields directly.
With full super admin rights, this can reveal the password hash (a scrambled form of a password) and the password reset token of every user. A reset token can be enough to take over an account. Lower-privileged admin accounts that can view basic details of API users could still extract sensitive information about all API users. Anyone running Strapi, especially internet-facing instances, should care. CISA has confirmed that this flaw has been exploited.