Strapi allows unauthenticated attacker to reset admin password without valid reset token

CRITICAL 9.8CVE-2019-18818 · GHSA-6xc2-mj39-q599 · Published 07/11/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
strapi strapi	`= 3.0.0≤ 1.6.4`	No fix yet
strapi npm	`< 3.0.0-beta.17.5`	`3.0.0-beta.17.5`

Description

Versions of strapi prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.

Recommendation

Upgrade to version 3.0.0-beta.17.5 or later.

NVD description

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

References

nvd.nist.gov/vuln/detail/CVE-2019-18818 · ADVISORY
strapi/strapi#4443 · WEB
cve.mitre.org/cgi-bin/cvename.cgi · WEB
strapi/strapi · PACKAGE
strapi/strapi release v3.0.0-beta.17.5 · WEB
npmjs.com/advisories/1311 · WEB
packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html · WEB
packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html · WEB
packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free