Strapi
Open-source Node.js headless content management system for building APIs.
Strapi's CVE-2023-22894 joined CISA's exploited list on 8 October 2026, after advisory AA26-281A tied it to hackers linked to Integrity Technology Group; federal agencies had until 11 October to deal with it.
Last refreshed: 12 October 2026
How did a Strapi admin-panel flaw end up in a China hacking advisory?
Timeline for Strapi
Mentioned in: Ten agencies name Beijing firm in hacks
Cybersecurity: Threats and DefencesBackground
Strapi is an open-source headless content management system written for Node.js. Development Teams host it themselves and use it to serve content through APIs.
Its 2023 flaw CVE-2023-22894 affects Strapi up to and including version 4.5.5. Anyone with access to the Strapi admin panel can abuse the query filter to pull sensitive user data, including password hashes and password reset tokens that carry super admin rights. CISA says an attacker can chain it with CVE-2023-22621 to run code remotely.
The bug reached CISA's Known Exploited Vulnerabilities catalogue on 8 October 2026, the day ten agencies listed it in AA26-281A among flaws used by actors connected to Integrity Technology Group. CISA set an 11 October Deadline and warned that the affected Strapi releases may be end-of-life.