Notifications
Clear all
Topic starter
21/08/2026 4:50 pm
TL;DR: A public Content API oracle, Content-Type Builder query injection, upload-policy bypasses, and refresh-token session retention can combine into account takeover and broader CMS compromise, according to Corgea’s analysis of the Strapi advisory cluster. The practical lesson is that CMS security now depends on hardening exposed request paths, not just patching dependencies.
NHIMG editorial — based on content published by Corgea: critical CVE advisories affecting Strapi packages and CMS access paths
By the numbers:
- CVE-2026-27886 affects @strapi/strapi from 4.0.0 through 5.36.1, with the fixed line at 5.37.0 or later.
- CVE-2026-22599 affects @strapi/content-type-builder from 5.0.0 through 5.33.1, while the plugin-content-type-builder line is affected through 4.26.0.
- CVE-2025-64526 affects @strapi/plugin-users-permissions up to 5.44.0, with remediation requiring 5.45.0 or later.
Questions worth separating out
Q: What breaks when public CMS filters can reach privileged identity fields?
A: Public filters can become a secret-recovery channel when they traverse into admin-related fields and return different responses for guessed values.
Q: Why do admin password resets not always end an attacker session?
A: Password resets only reduce risk if refresh tokens and other session artefacts are revoked at the same time.
Q: Where do CMS upload controls fail in practice?
A: They fail when a system allows active content such as HTML or SVG into a trusted origin used by administrators.
Practitioner guidance
- Harden public relational filters Block traversal from public content types into admin relation fields such as createdBy, updatedBy, and publishedBy.
- Treat schema tools as development-only Remove Content-Type Builder write routes from production exposure and verify that admin schema mutation endpoints are inaccessible outside trusted development environments.
- Revoke sessions during credential recovery Force refresh-token revocation whenever passwords or reset tokens are changed, and confirm that device-less sessions cannot survive account recovery.
What's in the full analysis
Corgea's full article covers the operational detail this post intentionally leaves for the source:
- Exact vulnerable package ranges and fixed versions for each affected Strapi line
- Request log patterns that distinguish oracle probing from normal public Content API usage
- Database and upload indicators that help separate schema injection from routine content updates
- Remediation steps for rotating admin reset tokens, revoking sessions, and isolating uploads
👉 Read Corgea's analysis of the Strapi advisory cluster and CMS identity risk →
Strapi security advisories: what CMS teams need to fix now?
Explore further
21/08/2026 5:08 pm
Privilege-containment failure is the real story here. The cluster is not just a patching problem. It shows what happens when public application logic, administrative identity fields, and session governance are allowed to overlap without hard boundaries. In identity terms, the issue is not only the existence of a token or admin account, but the ability of public request paths to reach it. Practitioners should treat CMS relation traversal as an identity boundary, not a convenience feature.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, according to The State of Secrets Sprawl 2026.
A question worth separating out:
Q: Who is accountable when schema administration reaches raw database execution?
A: The organisation that exposed the schema change path is accountable, because admin authentication does not justify production execution surfaces. Governance should require development-only access, change control, and logging for any route that can alter models, defaults, or migrations.
👉 Read our full editorial: Strapi advisories expose admin tokens, SQL injection, and auth gaps
