CVE-2023-22894 · High · CISA KEV

Strapi Cleartext Storage Vulnerability: Sensitive Data Exposure via Admin Panel

Threat Engine Auto-Feed · data current as of 2026-10-08

A cleartext storage vulnerability in Strapi allows authenticated attackers with admin panel access to expose sensitive user details through query filters. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. It can be chained with CVE-2023-22621 for remote code execution.

  • CVSS:
  • EPSS percentile: 0.7591
  • Exploitation pressure: 71/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 76th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves storing sensitive information, such as user details, in a way that is not encrypted or protected, making it readable in plain text. If an attacker gains access to the system, they can easily retrieve this sensitive data without needing to decrypt it.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Strapi, especially those in Financial Services and Technology sectors, due to documented adversary targeting.
  • Enterprises with internal-facing Strapi instances where admin panel access might be less stringently controlled.

Misconfigurations that escalate it

  • Insufficient access controls or monitoring for the Strapi admin panel.
  • Failure to update Strapi instances, particularly those that may be end-of-life (EoL) or end-of-service (EoS).

High-impact scenarios

  • Sensitive user data exposure, leading to privacy breaches, compliance violations, and potential identity theft.
  • Chaining with other vulnerabilities (e.g., CVE-2023-22621) to achieve remote code execution, escalating impact to full system compromise and data exfiltration.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Strapi admin panel access logs for unusual activity or unauthorized logins.
  • Implement robust logging and alerting for queries made through the Strapi admin panel that access sensitive data.

Contain

  • Restrict access to the Strapi admin panel to only authorized personnel and trusted networks.
  • Isolate affected Strapi instances from critical internal systems and sensitive data stores.

Patch

  • Discontinue use of end-of-life (EoL) or end-of-service (EoS) Strapi versions and transition to a supported version.
  • Apply available patches or updates for Strapi to address this cleartext storage vulnerability.

Frontier verdict — High

High priority due to active exploitation (CISA KEV) and potential for sensitive data exposure and remote code execution when chained.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.