strapi Vulnerabilities and Affected Products
Vulnerabilities associated with @strapi/plugin-users-permissions.
Products
Clear product- strapi28 vulnerabilities
- @strapi/plugin-users-permissions2 vulnerabilities
- @strapi/admin1 vulnerability
- @strapi/content-type-builder1 vulnerability
- @strapi/upload1 vulnerability
- strapi/strapi1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Strapi: Password Reset Does Not Revoke Existing Refresh SessionsStrapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An a… CWE-613May 14, 2026 | CVSS2.1v4.0 | EPSS0.272% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-64526MEDIUM | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingStrapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on routes whose body schema does not contain an `email` field (`/auth/local`, `/auth/reset-password`, `/auth/change-password`). An unauthenticated attacker could include an arbitrary `email` value in the request body to obtain a fresh rate-limit key per request, effect… CWE-307May 14, 2026 | CVSS6.9v4.0 | EPSS0.492% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |