Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Strapi bug bounty programs

strapi.io Updated

Strapi runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
12
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Strapi runs.

  • Strapi

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

12 targets. 6 excluded.

  • https://strapi.io

    Web

  • API tokens and transfer tokens, including their scoping, storage and revocation

    Products and areas

  • Authentication for both admin users and API consumers: JWT issuance and verification, refresh, registration, password reset, email confirmation and the SSO providers

    Products and areas

  • The admin RBAC model, covering custom roles, field-level and condition-based permissions, and the admin API behind the panel

    Products and areas

  • The content API in both its REST and GraphQL forms, generated from a project's content types and reachable by every front end the project serves

    Products and areas

  • The content-type builder and the schema files it writes to disk, which change the shape of the API at runtime

    Products and areas

  • The data transfer tooling and the import and export routines, which move whole datasets between environments

    Products and areas

  • The database query layer across every supported engine, particularly how filter, sort and populate parameters become a query

    Products and areas

  • The media library, the upload provider interface and the image processing that runs over uploaded files

    Products and areas

  • The plugin loader, the lifecycle hooks and the middleware chain every request passes through

    Products and areas

  • The policy declares scope by version: v5.x GA and stable releases plus every @strapi/* package in the monorepo, with EOL v3.x and v4.x, non-GA tags, marketplace plugins and forks named out

    Products and areas

  • The users-permissions layer, which decides which role reaches which route and which field on the public-facing API

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A role or permission an operator configured deliberately, rather than a check the framework failed to apply

  • Anything reproducing only under strapi develop, excluded by name; the policy accepts findings against strapi start with a hardened production configuration

  • EOL v3.x and v4.x releases, non-GA tags, marketplace plugins and forks, all named out by the policy's scope statement

  • Reports routed through huntr or any other platform the policy states it does not support, and reports sent to the security address by researchers who could have used GitHub

  • Strapi Cloud tenants, which the policy places out of scope for testing and which carry no bounty

  • Upstream Node, framework and database defects, unless Strapi's own use of them is what makes the issue reachable

Recent changes

Reward and scope changes across every Strapi program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Strapi products, from the NVD.

Search NVD
  • CVE-2026-57997 Medium

    Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.

  • CVE-2026-27886 Critical

    Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` (or other admin-relation) field to perform a boolean-oracle attack

  • CVE-2026-22706 Low

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request di

  • CVE-2026-22707 Medium

    Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions (`plugin.upload.security.allowedTypes` and `deniedTypes`). The same restrictions were correctly enforced on the Admin Panel upload path. The upload plugin's `enforceUploadSecurity` security che

  • CVE-2026-22599 Critical

    Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. S

  • CVE-2025-64526 Medium

    Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on routes whose body schema does not contain an `email` field (`/auth/local`, `/auth/reset-password`, `/auth/change-password`). An unauthenticated attacker could include

  • CVE-2025-53092 Medium

    Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the

  • CVE-2025-25298 Medium

    Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the

About this page

This page gathers every public program listed under strapi.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.