CVE-2021-28128: Strapi

High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days.

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.

Affected products

• Strapi Strapi: up to and including 3.6.0

Published 2021-05-06. Last modified 2026-06-17.