CVE-2023-36472: Strapi

Medium severity, CVSS 5.7. EPSS: 0.7% chance of exploitation in the next 30 days.

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.

Affected products

• Strapi Strapi: before 4.11.7 (fixed in 4.11.7)

Published 2023-09-15. Last modified 2026-06-17.