Strapi advisories expose admin tokens, SQL injection, and auth gaps

At a glance

What this is: Corgea’s analysis shows that multiple Strapi flaws can expose admin secrets, enable database injection, bypass upload restrictions, and preserve sessions after password changes.

Why it matters: It matters to IAM and application security teams because CMS admin accounts, refresh tokens, and upload controls are identity and access boundaries, not just application features.

By the numbers:

• The 2025 advisory set maps five affected Strapi package lines across public Content API, Content-Type Builder, upload, admin, and users-permissions surfaces.
• CVE-2026-27886 affects @strapi/strapi from 4.0.0 through 5.36.1, with the fixed line at 5.37.0 or later.
• CVE-2026-22599 affects @strapi/content-type-builder from 5.0.0 through 5.33.1, while the plugin-content-type-builder line is affected through 4.26.0.
• CVE-2025-64526 affects @strapi/plugin-users-permissions up to 5.44.0, with remediation requiring 5.45.0 or later.

👉 Read Corgea's analysis of the Strapi advisory cluster and CMS identity risk

Context

Strapi security issues matter because CMS platforms often sit directly in production request paths, where public content access, authenticated schema changes, file uploads, and login throttling all intersect with identity control. When those surfaces fail, the result is not only application compromise but exposure of tokens, sessions, and administrative privilege.

The primary lesson from this advisory cluster is that CMS hardening must treat admin relations, refresh tokens, and upload permissions as access-control boundaries. In identity terms, the attack surface includes human administrator accounts and the non-human secrets that let those accounts persist or be impersonated.

This pattern is common in modern CMS environments where development assumptions leak into production, especially when schema tools remain reachable, upload restrictions are enforced inconsistently, or session revocation is incomplete after credential changes.

Key questions

Q: What breaks when public CMS filters can reach privileged identity fields?

A: Public filters can become a secret-recovery channel when they traverse into admin-related fields and return different responses for guessed values. That lets an attacker test tokens character by character, which is why query design must be treated as an identity control, not just an application feature.

Q: Why do admin password resets not always end an attacker session?

A: Password resets only reduce risk if refresh tokens and other session artefacts are revoked at the same time. If token state survives the reset, the attacker can stay authenticated even after the password changes, so identity recovery must include session invalidation and audit checks.

Q: Where do CMS upload controls fail in practice?

A: They fail when a system allows active content such as HTML or SVG into a trusted origin used by administrators. At that point the file is no longer just content, because a privileged user who opens it may hand the attacker script execution or session leverage.

Q: Who is accountable when schema administration reaches raw database execution?

A: The organisation that exposed the schema change path is accountable, because admin authentication does not justify production execution surfaces. Governance should require development-only access, change control, and logging for any route that can alter models, defaults, or migrations.

Technical breakdown

How the public Content API oracle exposes restricted admin data

CVE-2026-27886 is a query-sanitisation failure. A public content endpoint accepts relational filters that should stop at the boundary between public records and restricted admin-user fields, but instead it traverses relations such as updatedBy, createdBy, or publishedBy. Because the application returns different responses depending on whether a guessed value matches, an attacker can use the API as a boolean oracle and test secret values character by character. That turns ordinary filtering logic into a credential-recovery primitive.

Practical implication: public APIs must block relational traversal into privileged identity fields before release to production.

Why Content-Type Builder writes can become database execution

CVE-2026-22599 affects authenticated administrators using Content-Type Builder. The vulnerable path accepts a raw default value tuple that reaches Knex’s raw execution layer during schema migration, so an application-level admin action can become a database-layer statement injection. Depending on the backend and runtime, that may produce arbitrary SQL execution, file read primitives, denial of service, or database-server code execution. Strapi’s fix effectively removes the production write surface by returning 404 outside development mode, which shows how dangerous schema mutation endpoints are when exposed beyond their intended lifecycle.

Practical implication: restrict schema mutation routes to development networks and treat admin write APIs as privileged execution paths.

How upload and session flaws expand containment failure

The remaining advisories widen blast radius rather than opening the initial foothold. Upload-policy bypasses let authenticated users place active content such as HTML or SVG where administrators may later open it in the admin origin, while missing deviceId handling can leave refresh tokens valid after password changes. The auth-throttling issue also weakens the friction on brute-force attempts against login and reset routes. Taken together, these are containment failures: one flaw enables entry, and the others help the attacker persist, escalate, or evade normal recovery steps.

Practical implication: session revocation, upload isolation, and route-specific rate limiting must be validated together, not separately.

Threat narrative

Attacker objective: The attacker aims to recover privileged credentials or session continuity and then turn CMS access into durable administrative or database control.

1. Entry occurs through public Content API requests that probe relational filters on admin-linked fields until a response oracle reveals candidate secret values.
2. Credential access follows when repeated queries recover reset-password tokens or other privileged identity data, allowing abuse of the admin account boundary.
3. Escalation and impact occur when an attacker uses admin access, upload bypasses, or preserved refresh sessions to maintain control, modify content types, or reach the database layer.

Breaches seen in the wild

• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privilege-containment failure is the real story here. The cluster is not just a patching problem. It shows what happens when public application logic, administrative identity fields, and session governance are allowed to overlap without hard boundaries. In identity terms, the issue is not only the existence of a token or admin account, but the ability of public request paths to reach it. Practitioners should treat CMS relation traversal as an identity boundary, not a convenience feature.

Boolean-oracle probing is a named governance gap, not just an exploit technique. The article demonstrates a pattern where response differences turn public filters into secret-recovery tooling. That is a governance failure because the application discloses whether a privileged value exists, which creates a viable path to admin reset-token recovery. The implication for NHI and IAM teams is that secret exposure can emerge from query design as easily as from secret storage.

Content-Type Builder exposure turns schema administration into a privileged execution plane. When schema changes can reach raw database execution, the application has crossed from business logic into infrastructure control. That matters for identity governance because administrator roles are often assumed to be safe once authenticated, yet this flaw shows that some admin functions should be treated as code execution surfaces. Practitioners need a sharper distinction between day-to-day admin access and development-only system mutation.

Session revocation is part of identity recovery, not an optional cleanup step. The users-permissions issues show that password changes do not automatically end an attacker’s foothold if refresh tokens remain valid or throttling is weak. This is especially relevant in CMS environments where human admin accounts and non-human session artefacts are managed separately. Teams should align recovery procedures with OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev 5 Security and Privacy Controls so revocation, authentication, and audit are handled as one control set.

Upload policy bypasses expand identity risk into browser-executable content. Allowing HTML or SVG through a CMS upload path is not only a file-control issue. It can become an admin-session compromise if a privileged user opens the content inside the trusted origin. That is why this advisory belongs in identity discussions as well as application security: the blast radius depends on who can load the file and what privileges their session carries.

From our research:

• 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
• From our research: 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, according to The State of Secrets Sprawl 2026.
• Forward look: The 52 NHI breaches Report shows how exposed credentials and weak offboarding controls keep turning token leaks into account compromise.

What this signals

Boolean-oracle exposure should now be treated as an identity detection problem as much as an application flaw. If public request paths can reveal whether a privileged value exists, security teams need monitoring that correlates repeated filter variation, reset-token access, and follow-on admin actions. The control objective is not just patching the API, but reducing the time between token exposure and revocation. For identity teams, that means aligning CMS recovery workflows with the same discipline used for OWASP Non-Human Identity Top 10.

CMS privilege boundaries are tightening around admin sessions and non-human secrets. In environments like this, the difference between a routine admin login and an abuse path is often whether the session can still write schema, upload active files, or retain refresh tokens after recovery. Organisations should expect more scrutiny of admin-origin separation and lifecycle controls, because NIST SP 800-53 Rev 5 Security and Privacy Controls already frames access control, authentication, and audit as linked obligations, not separate tasks. The practical signal is simple: if recovery does not revoke access, it is not recovery.

Privilege-containment failure: the CMS can expose more than content when admin fields, uploads, and sessions are allowed to overlap. Teams that manage both human admins and NHI-style session artefacts should review whether their identity lifecycle assumptions still hold when application logic becomes a secret oracle or execution surface. That is where The 52 NHI breaches Report becomes useful, because it shows how often exposed credentials, weak revocation, and missing offboarding controls turn a single flaw into sustained compromise.

For practitioners

• Harden public relational filters Block traversal from public content types into admin relation fields such as createdBy, updatedBy, and publishedBy. Test for boolean-oracle behaviour by comparing responses across repeated probes and confirm that privileged fields never influence public output. Suggested control focus is on request validation at the API boundary.
• Treat schema tools as development-only Remove Content-Type Builder write routes from production exposure and verify that admin schema mutation endpoints are inaccessible outside trusted development environments. Review every route that can alter content models, defaults, or migrations as if it were privileged execution.
• Revoke sessions during credential recovery Force refresh-token revocation whenever passwords or reset tokens are changed, and confirm that device-less sessions cannot survive account recovery. Validate that admin and users-permissions sessions are terminated as part of the same incident response workflow.
• Isolate active uploads from the admin origin Serve uploaded files from a separate origin and block active content types such as HTML and SVG unless they are explicitly required and sanitised. Check whether upload permissions can place executable content where administrative sessions can render it.
• Audit auth routes for throttling bypasses Review /api/auth/local, /api/auth/reset-password, and /api/auth/change-password for rate limits that depend on attacker-controlled fields or inconsistent identity keys. Ensure that brute-force resistance is enforced on the actual account identifier, not an optional request body value.

Key takeaways

• The advisory cluster shows that a CMS can fail as an identity boundary, not just an application boundary.
• The evidence points to multiple privilege paths at once: token disclosure, schema injection, upload bypass, and incomplete session revocation.
• Teams should treat public filter design, admin route exposure, and refresh-token invalidation as one governance problem.

Key terms

• Boolean Oracle: A Boolean oracle is an API or endpoint that reveals useful information through a simple true or false response. Attackers use it to confirm whether an identity exists, whether a resource is valid, or whether a condition has been met, then automate that check across large datasets for profiling or fraud.
• Session revocation: The ability to invalidate active sessions so access ends immediately instead of waiting for tokens or browser state to expire. For identity governance, this is the control that determines whether authentication still matters after a compromise is detected.
• Content-Type Builder: A content-type builder is an administrative feature that lets operators change schemas, attributes, and data model behaviour from within the application. It is highly privileged because changes made there can affect database structure, access behaviour, and execution paths, especially if the tool remains reachable outside development environments.
• Upload Policy Bypass: An upload policy bypass occurs when a system accepts files or content that should have been blocked by allowlists, denylists, or MIME rules. The risk increases when the accepted file can execute active content in a trusted origin, turning a content feature into a session compromise path.

What's in the full analysis

Corgea's full article covers the operational detail this post intentionally leaves for the source:

• Exact vulnerable package ranges and fixed versions for each affected Strapi line
• Request log patterns that distinguish oracle probing from normal public Content API usage
• Database and upload indicators that help separate schema injection from routine content updates
• Remediation steps for rotating admin reset tokens, revoking sessions, and isolating uploads

👉 The full Corgea post covers affected versions, detection cues, and remediation steps for the Strapi flaws.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect application exposure, token lifecycle, and access governance in one operating model.