Strapi CVE-2026-27886

Exploitation requires a publicly-accessible (unauthenticated) Strapi Content API endpoint serving a content-type that includes at least one admin-relation field-specifically updatedBy, createdBy, or publishedBy. These fields are present by default in nearly all Strapi content-types when draft/publish or audit features are enabled. Additionally, successful account takeover via the extracted resetPasswordToken requires that an administrator has initiated a password reset flow within the token's validity window (typically 10-60 minutes), meaning the resetPasswordToken column in the admin_users table is non-null. If no active reset token exists, the attacker can still extract other sensitive admin fields (email addresses, hashed passwords, personal names) via the same oracle technique, enabling credential stuffing or social engineering follow-on attacks. Limiting exploitation: authenticated-only API configurations (all content-types require JWT or API token) completely block this attack vector by removing the unauthenticated entry point. Private Strapi instances not exposed to the public internet (internal CMS, localhost development) have no remote attack surface. Strapi Cloud deployments are affected identically to self-hosted if running vulnerable versions. Default installations with public content-types and at least one published article/post are exploitable.

Critical priority for immediate remediation in internet-facing Strapi deployments. CVSS 9.3 accurately reflects the attack surface: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), high confidentiality impact on both vulnerable and subsequent systems (VC:H, SC:H). The boolean-oracle technique is well-understood and automatable-a competent attacker can write a script to extract a 32-character reset token in under 1,000 requests (5 bits/char × 32 chars × ~6 guesses per character with hex charset). Administrative account compromise enables complete CMS control, including content manipulation, plugin installation for persistence, and database access. The vulnerability affects a broad installed base (Strapi powers 60,000+ production sites per GitHub stars) and specifically targets the default relational field pattern used in virtually all Strapi content-types. However, exploitation requires: (1) at least one public (unauthenticated) content-type endpoint, (2) that content-type must include an admin-relation field like updatedBy, and (3) the admin user must have an active resetPasswordToken value (non-null) in the database, which only exists temporarily after initiating a password reset flow. Deployments with fully authenticated APIs or those using custom authentication bypassing Strapi's reset mechanism face reduced risk. No EPSS score, KEV listing, or public POC available, indicating this is likely a researcher-discovered and responsibly disclosed bug rather than an exploited-in-wild threat. Still, the technical barrier is low and the impact severe-treat as high priority despite absence of observed exploitation.

An attacker identifies a Strapi-powered blog at example.com running version 5.30.0 by fingerprinting the /admin login page. They discover the public /api/articles endpoint returns a list of blog posts, each with an updatedBy relation to admin users. The attacker scripts a boolean-oracle extraction attack: first, they query GET /api/articles?where[updatedBy][resetPasswordToken][$startsWith]=0 and observe the response count. If zero results, the token does not start with '0'; if non-zero, it does. They repeat with 1, 2...f, identifying the first character. Once the first character is known (say, 'a'), they query ?where[updatedBy][resetPasswordToken][$startsWith]=a0, a1...af to determine the second character. After 800-1000 requests over 10 minutes, they reconstruct the full 32-character reset token a3f7b2...9c8e. They then POST the extracted token to /admin/reset-password with a new password, gaining full administrative access to create malicious content, install backdoor plugins, or exfiltrate the customer database. The entire attack requires no authentication, no user interaction, and leaves minimal forensic trace beyond routine API access logs unless the regex IoC pattern is monitored.