CVE-2023-22894Vulnerability
Strapi Cleartext Storage of Sensitive Information Vulnerability
Reported by 5 independent sources · first reported by CISA advisories · last reported
Last reported 13 days ago
Fix due 11 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 89% of CVEsFIRST EPSS, as of 24 Oct 2026
What the reports say
6 reports, newest first · the exact sentence from each-
Bulletin d'actualité CERTFR-2026-ACT-043 (12 octobre 2026)“CVE-2023-22894”
-
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog“CVE-2023-22894 (CVSS score of 7.2) – A vulnerability in Strapi that exposes sensitive information stored in cleartext.”
-
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies“CVE-2023-22894 (CVSS score: 7.2) - A cleartext storage of sensitive information vulnerability in Strapi that could allow an attacker with access to the admin panel to discover sensitive user details via the query filter.”
-
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide“…y (CISA) has added five CVEs to its Known Exploited Vulnerabilities Catalog: CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2021-3199 CVE-2023-22894 The court-authorized seizures are the latest in a long series of US law-enforcement attempts to disrupt a Beijing-backed cybercrew c…”
-
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails“CVE-2023-22894*”
-
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data“CVE-2023-22894”
Indicators reported together
named in the same reports- hxxps://docs.gitlab[.]com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/in 1 report
- hxxps://confluence.atlassian[.]com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.htmlin 1 report
- hxxps://psirt.global.sonicwall[.]com/vuln-detail/SNWLID-2026-0017in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2019-11510, CVE-2014-6278, CVE-2021-22205, CVE-2026-90970, CVE-2026-21589, CVE-2026-102255, CVE-2026-102256, CVE-2026-102257, CVE-2026-102258, CVE-2026-76742, CVE-2026-76743, CVE-2026-79801, CVE-2026-79805
Thanks — we review every report.