{"cve":"CVE-2022-30618","nvd":{"published":"2022-05-19T18:15:09.637","modified":"2026-06-17T04:43:57.240","status":"Modified","description":"An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5},"cwes":["CWE-212"],"references":["https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi","https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi"],"products":["strapi:strapi"],"source":"nvd","synced_at":"2026-10-19T21:31:59.322382750+00:00"},"epss":{"cve":"CVE-2022-30618","score":0.00963,"percentile":0.61681,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vgj7-895j-gpr6","url":"https://osv.dev/vulnerability/GHSA-vgj7-895j-gpr6","summary":"Improper Removal of Sensitive Information Before Storage or Transfer in Strapi","modified":"2023-11-08T04:09:19.047645Z","packages":[{"ecosystem":"npm","name":"strapi","purl":"pkg:npm/strapi","ranges":[">=3.0.0 <3.6.9"],"fixed":["3.6.9"]},{"ecosystem":"npm","name":"@strapi/strapi","purl":"pkg:npm/%40strapi/strapi","ranges":["<4.1.9"],"fixed":["4.1.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}