Strapi Allows Unauthorized Access to Private Fields via parms.lookup
- Severity:
- High
Description
It’s possible to access any private fields by filtering through the lookup parameters
Recommendation
Update the @strapi/core package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.0.0, < 5.5.2
- Patched version(s): 5.5.2
References
Related Issues
- Unauthorized Access to Private Fields in User Registration API - @strapi/plugin-users-permissions - CVE-2023-39345
- Unauthorized Access to Private Fields in User Registration API - CVE-2023-39345
- Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
- Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - CVE-2026-46396
You might also like:
- Tags:
- npm
- @strapi/core
Anything's wrong? Let us know
Last updated on October 16, 2025