Strapi allows unauthenticated attacker to reset admin password without valid reset token

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-18818 · ADVISORY
• strapi/strapi#4443 · WEB
• cve.mitre.org/cgi-bin/cvename.cgi · WEB
• strapi/strapi · PACKAGE
• strapi/strapi release v3.0.0-beta.17.5 · WEB
• npmjs.com/advisories/1311 · WEB
• packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html · WEB
• packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html · WEB
• packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html · WEB

strapi のその他の脆弱性

• CVE-2026-57997中 5.4Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, …
• CVE-2026-27886高 7.5Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sani…
• CVE-2026-22707中 5.4Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints d…
• CVE-2026-22706中 6.5Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did…
• CVE-2026-22599高 7.2Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.…