CVE-2026-27886

An attacker sends a GET request to a publicly accessible Content API endpoint, passing a `where` parameter pointing to a relational field (e.g., `updatedBy`), and then nesting a reference to a private field of the `admin_users` table, such as `where[updatedBy][resetPasswordToken][$startsWith]=a`. The sanitization layer did not block operator strings passing to relationship target schemas that the caller had no read permissions for. As a result, the database executed a `LEFT JOIN` on the `admin_users` table and emitted a `WHERE` clause referencing the private field — the number of returned results acted as a one-bit boolean oracle. By repeating queries with different prefixes, an attacker could brute-force the complete value of the administrator's password reset token and reset the administrator's password.

An unauthenticated attacker can read the password reset token of any administrator account and perform complete account takeover of an administrative account without any credentials.

Strapi should be updated to version 5.37.0 or later. Version 5.37.0 introduces explicit sanitization of query parameters at the controller and service boundary using new primitives `strictParam`, `addQueryParams`, and `addBodyParams`, which reject operator strings passing to restricted relational targets before reaching the database. If immediate update is not possible, consider restricting access to public Content API endpoints at the firewall or reverse proxy level.

Strapi versions from 4.0.0 to (but not including) 5.37.0