Improper Removal of Sensitive Information Before Storage or Transfer in Strapi

Description

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions).

Recommendation

Update the @strapi/strapi package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.1.9
• Patched version(s): 4.1.9

References

• GHSA-vgj7-895j-gpr6
• www.synopsys.com
• CVE-2022-30618
• CWE-212
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) 3 - CVE-2020-28500
• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-x5rq-j2xg-h7qm) - CVE-2019-1010266
• Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
• Payload's SQLite adapter Session Fixation vulnerability (GHSA-26rv-h2hf-3fw4) 2 - CVE-2025-4644

Tags:

npm

@strapi/strapi