Improper Removal of Sensitive Information Before Storage or Transfer in Strapi (GHSA-f6fm-r26q-p747)

Description

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user.

Recommendation

Update the @strapi/strapi package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.0.0-beta.14
• Patched version(s): 4.0.0-beta.15

References

• GHSA-f6fm-r26q-p747
• www.synopsys.com
• CVE-2022-30617
• CWE-212
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` (GHSA-6465-jgvq-jhgp) 9 - CVE-2025-65944
• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` (GHSA-6465-jgvq-jhgp) 7 - CVE-2025-65944
• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` (GHSA-6465-jgvq-jhgp) 6 - CVE-2025-65944
• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` (GHSA-6465-jgvq-jhgp) 5 - CVE-2025-65944

Tags:

npm

@strapi/strapi