Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
BREACH WATCH BRIEF High 💀 Vulnerability

Cleartext Storage of Sensitive Data in Strapi (CVE‑2023‑22894) Risks Admin‑Panel Confidentiality

Strapi’s CMS stores user details in cleartext, allowing anyone with admin‑panel access to read them. The issue also enables a chain to remote code execution, highlighting the need for encryption‑at‑rest controls and audit‑ready evidence.

ADTP Breach Watch · October 8, 2026 · CISA KEV
SeverityHigh
Type💀 Vulnerability
ConfidenceHigh
ReportedOct 8, 2026
Technology & SaaS Technology – SaaS platforms using Strapi as a headless CMS Vulnerability Exploit

What happened

A vulnerability (CVE‑2023‑22894) in Strapi allows an attacker with admin‑panel access to query and retrieve sensitive user information stored in cleartext. When combined with CVE‑2023‑22621, the flaw can lead to remote code execution on the host system.

Why it matters for trust and compliance

  • The flaw directly challenges the control objective of protecting data at rest, a core requirement for audit readiness across multiple frameworks. Remediating it provides tangible evidence of encryption controls for auditors and continuous‑monitoring programs.
  • Provides a clear audit artifact: encrypted vs. cleartext storage status.
  • Enables continuous evidence collection to prove compliance with data‑protection controls.

Who is affected

Technology – SaaS platforms using Strapi as a headless CMS

Recommended actions

  1. Identify all Strapi deployments, retire unsupported versions, and upgrade to the patched release.
  2. Encrypt all database columns that hold PII or other sensitive data.
  3. Implement MFA and least‑privilege roles for admin console access.
  4. Run a control‑mapping scan to verify no other cleartext fields exist.

Details

Organizations
Strapi
CVEs
CVE-2023-22894

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.