- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 40
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://strapi.io
Products and areas 11
- API tokens and transfer tokens, including their scoping, storage and revocation
- Authentication for both admin users and API consumers: JWT issuance and verification, refresh, registration, password reset, email confirmation and the SSO providers
- The admin RBAC model, covering custom roles, field-level and condition-based permissions, and the admin API behind the panel
- The content API in both its REST and GraphQL forms, generated from a project's content types and reachable by every front end the project serves
- The content-type builder and the schema files it writes to disk, which change the shape of the API at runtime
- The database query layer across every supported engine, particularly how filter, sort and populate parameters become a query
- The data transfer tooling and the import and export routines, which move whole datasets between environments
- The media library, the upload provider interface and the image processing that runs over uploaded files
- The plugin loader, the lifecycle hooks and the middleware chain every request passes through
- The policy declares scope by version: v5.x GA and stable releases plus every @strapi/* package in the monorepo, with EOL v3.x and v4.x, non-GA tags, marketplace plugins and forks named out
- The users-permissions layer, which decides which role reaches which route and which field on the public-facing API
Out of scope (6)
- Anything reproducing only under strapi develop, excluded by name; the policy accepts findings against strapi start with a hardened production configuration
- A role or permission an operator configured deliberately, rather than a check the framework failed to apply
- EOL v3.x and v4.x releases, non-GA tags, marketplace plugins and forks, all named out by the policy's scope statement
- Reports routed through huntr or any other platform the policy states it does not support, and reports sent to the security address by researchers who could have used GitHub
- Strapi Cloud tenants, which the policy places out of scope for testing and which carry no bounty
- Upstream Node, framework and database defects, unless Strapi's own use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through a GitHub Security Advisory on strapi/strapi
-
GHSA is the only accepted intake channel for security reports
-
AI usage must be disclosed, attachments are not accepted, reports must be in English
-
Development mode is excluded outright
-
Strapi Cloud has no bounty either and its tenants are out of scope for testing
Not accepted
-
A role or permission an operator configured deliberately, rather than a check the framework failed to apply
-
Upstream Node, framework and database defects, unless Strapi's own use of them is what makes the issue reachable
-
Anything that reproduces under strapi develop and not under strapi start with a hardened production configuration
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-57997 | Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls. | Medium 6.3 | 29 Jun 2026 |
| CVE-2026-27886 | Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` (or other admin-relation) field to perform a boolean-oracle attack | Critical 9.2 | 14 May 2026 |
| CVE-2026-22706 | Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request di | Low 2.1 | 14 May 2026 |
| CVE-2026-22707 | Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions (`plugin.upload.security.allowedTypes` and `deniedTypes`). The same restrictions were correctly enforced on the Admin Panel upload path. The upload plugin's `enforceUploadSecurity` security che | Medium 5.3 | 14 May 2026 |
| CVE-2026-22599 | Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type. S | Critical 9.3 | 14 May 2026 |
| CVE-2025-64526 | Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin derived its rate-limit key in part from `ctx.request.body.email`, including on routes whose body schema does not contain an `email` field (`/auth/local`, `/auth/reset-password`, `/auth/change-password`). An unauthenticated attacker could include | Medium 6.9 | 14 May 2026 |
| CVE-2025-53092 | Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the | Medium 6.5 | 16 Oct 2025 |
| CVE-2025-25298 | Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the | Medium 6.3 | 16 Oct 2025 |
| CVE-2024-56143 | Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2. | High 8.2 | 16 Oct 2025 |
| CVE-2024-52588 | Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery (SSRF). This issue has been patched in version 4.25.2. | Medium 4.9 | 29 May 2025 |
| CVE-2024-37818 | Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue is not valid. They contend that "the strapi/admin was wrongly attributed a flaw that only pertains t | High 8.6 | 20 Jun 2024 |
| CVE-2024-29181 | Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrad | Low 2.3 | 12 Jun 2024 |
| CVE-2024-31217 | Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server | Medium 5.3 | 12 Jun 2024 |
| CVE-2024-34065 | Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated att | High 7.1 | 12 Jun 2024 |
| CVE-2023-48218 | The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds. | Medium 5.3 | 20 Nov 2023 |
| CVE-2023-39345 | strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. | High 7.6 | 6 Nov 2023 |
| CVE-2023-38507 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue. | High 7.3 | 15 Sep 2023 |
| CVE-2023-37263 | Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue. | Medium 6.8 | 15 Sep 2023 |
| CVE-2023-36472 | Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7. | Medium 5.8 | 15 Sep 2023 |
| CVE-2023-34235 | Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from `password` to `t1.password`. `password` is p | High 8.6 | 25 Jul 2023 |
| CVE-2023-34093 | Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `priv | Medium 4.8 | 25 Jul 2023 |
| CVE-2023-22621 | Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution. | High 7.2 | 19 Apr 2023 |
| CVE-2023-22893 | Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication. | High 7.5 | 19 Apr 2023 |
| CVE-2023-22894 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attac | Medium 4.9 | 19 Apr 2023 |
| CVE-2022-31367 | Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. | High 8.8 | 27 Sep 2022 |
| CVE-2022-32114 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside | High 8.8 | 13 Jul 2022 |
| CVE-2022-29894 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege. | Medium 4.8 | 13 Jun 2022 |
| CVE-2022-30617 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin | High 8.8 | 19 May 2022 |
| CVE-2022-30618 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a | High 7.5 | 19 May 2022 |
| CVE-2021-46440 | Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks. | High 7.5 | 3 May 2022 |
| CVE-2022-27263 | An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file. | Critical 9.8 | 12 Apr 2022 |
| CVE-2022-0764 | Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0. | Medium 6.7 | 26 Feb 2022 |
| CVE-2021-28128 | In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password. | High 8.1 | 6 May 2021 |
| CVE-2020-27664 | admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality. | Critical 9.8 | 22 Oct 2020 |
| CVE-2020-27665 | In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes. | High 7.5 | 22 Oct 2020 |
| CVE-2020-27666 | Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature. | Medium 5.4 | 22 Oct 2020 |
| CVE-2020-13961 | Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails. | Medium 6.5 | 19 Jun 2020 |
| CVE-2020-8123 | A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application. | Medium 4.9 | 4 Feb 2020 |
| CVE-2019-19609 | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function. | High 7.2 | 5 Dec 2019 |
| CVE-2019-18818 | strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. | Critical 9.8 | 7 Nov 2019 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 8 Last 12 months Access control 40 % Auth bypass 25 % Injection 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Strapi is the Node headless CMS teams put in front of their own database and then expose to a public front end, at roughly 851,000 npm installs a month. The permission layer is the product: every REST and GraphQL route is gated by a role configuration an operator clicks together in the admin panel, so a defect there publishes a customer table rather than a blog post. Eight advisories landed in the last twelve months, two of them critical in a single batch in May. The policy is unusually blunt about money, ruling out bounties or any other reward and refusing to negotiate compensation at all. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy declares scope by version: v5.x GA and stable releases plus every @strapi/* package in the monorepo, with EOL v3.x and v4.x, non-GA tags, marketplace plugins and forks named out The content API in both its REST and GraphQL forms, generated from a project's content types and reachable by every front end the project serves The users-permissions layer, which decides which role reaches which route and which field on the public-facing API The admin RBAC model, covering custom roles, field-level and condition-based permissions, and the admin API behind the panel Authentication for both admin users and API consumers: JWT issuance and verification, refresh, registration, password reset, email confirmation and the SSO providers API tokens and transfer tokens, including their scoping, storage and revocation The media library, the upload provider interface and the image processing that runs over uploaded files The content-type builder and the schema files it writes to disk, which change the shape of the API at runtime The plugin loader, the lifecycle hooks and the middleware chain every request passes through The data transfer tooling and the import and export routines, which move whole datasets between environments The database query layer across every supported engine, particularly how filter, sort and populate parameters become a query Out of scope EOL v3.x and v4.x releases, non-GA tags, marketplace plugins and forks, all named out by the policy's scope statement Anything reproducing only under strapi develop , excluded by name; the policy accepts findings against strapi start with a hardened production configuration Strapi Cloud tenants, which the policy places out of scope for testing and which carry no bounty Reports routed through huntr or any other platform the policy states it does not support, and reports sent to the security address by researchers who could have used GitHub Upstream Node, framework and database defects, unless Strapi's own use of them is what makes the issue reachable A role or permission an operator configured deliberately, rather than a check the framework failed to apply Most-valued findings Anything the public role reaches that it should not. The default public role is the first thing every Strapi install exposes and the most misconfigured surface in the product, so a core defect there is exploitable across the whole install base at once Admin RBAC bypass, custom role upward to super admin, on a panel that also writes schema files and can change the API's shape Authentication defects in JWT issuance, verification or password reset on either the admin or the API consumer path. Two criticals landed in a single batch in May 2026 API token and transfer token handling, where a scoped token reaches unscoped data or a token minted for one environment works against another Injection through the query layer, particularly filter, sort and populate parameters that pass request input into a database query Field-level permission leaks through GraphQL or through a populated relation, where a field denied on a direct read returns via another route Upload handling and the provider interface, where a file lands somewhere it is served from or executed Anything reproducible under strapi start with a hardened production config, since that is the only configuration the policy will accept a report against Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Submit through a GitHub Security Advisory on strapi/strapi . The policy states in capitals that GHSA is the only accepted intake channel for security reports [email protected] exists only for researchers in jurisdictions where GitHub is blocked or restricted, and the policy states it is not an escalation channel In scope: v5.x GA and stable releases plus every @strapi/* package in the monorepo. Out: v3.x and v4.x, non-GA tags, marketplace plugins and forks Development mode is excluded outright. Anything that reproduces under strapi develop and not under strapi start with a hardened production configuration will be closed AI usage must be disclosed, attachments are not accepted, reports must be in English, and the project publishes no response SLA Strapi Cloud has no bounty either and its tenants are out of scope for testing. The policy also names huntr.dev among platforms it does not support Disclosure Coordinated through the GitHub advisory flow and published as a GHSA on strapi/strapi alongside a patched release, in batches tied to those releases: five advisories landed together on 13 May 2026. Paid Strapi tiers receive pre-disclosure notification, so the practical embargo runs at least as long as that notice period. No day count and no response time are published anywhere, so expect to wait and agree a date in the advisory thread. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability