CVE-2022-30618

    Dashboard / Vulnerabilities / CVE-2022-30618

    CVE-2022-30618

    Published: 19 May 2022Last Modified: 12 Aug 2026

    Summary:

    Details: An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30618.json, https://nvd.nist.gov/vuln/detail/CVE-2022-30618, https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6bb7a7f198b13b0780547285d4214704ce991c23
    Fixed -86f882bc154e16321fbc83d0086e0d956bb5e82a

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-30618 | CVE-DB