Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NStrapi
APPStrapi5.0.0 – 5.5.2 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2026-22599CRITICAL9.3PL ✓same product
SQL Injection w Strapi Content-Type Builder — możliwe RCE i odczyt plików
CVE-2026-27886CRITICAL9.2PL ✓same product
Strapi: Path Traversal w filtrach relacyjnych umożliwia przejęcie konta admina
CVE-2022-27263CRITICAL9.8PL ✓same product
Arbitrary file upload umożliwiający RCE w Strapi v4.1.5
CVE-2020-27664CRITICAL9.8PL ✓same product
Nieautoryzowany endpoint proxy w Strapi — podatność SSRF/proxy
CVE-2019-18818CRITICAL9.8PL ✓same product
Błędna obsługa resetowania hasła w Strapi przed v3.0.0-beta.17.5