Dashboard / CVE-2024-56143

CVE-2024-56143

HIGH
MEDIUM Priority: 0.03 BB Relevance: 76/100
Published: 2025-10-16 Modified: 2026-11-09 First seen: 2026-11-09 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: Low
A: None

Description

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
strapi strapi 5.0.0 – 5.5.2

References & Advisories (2)

Bug Bounty Relevance

76 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.2 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS — Exploitation Probability

0.42%
Raw Score 0.004180
Percentile 36.6%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00418
2026-11-12
0.00418
2026-11-10
0.00418
2026-11-09
0.00422
2026-11-08
0.00418

Intelligence Sources

nvd ref →

External Links