CISA's October 8, 2026 KEV additions included CVE-2023-22894 affecting Strapi. The federal due date is October 11, 2026. Public advisories describe a cleartext / information-exposure class issue: an authenticated admin-panel user could discover sensitive user details by filtering on private fields. Affected versions are commonly cited as 3.2.1 through 4.7.1, with a fix in 4.8.0. Strapi's own April 2023 security disclosure also warned that chaining related issues could escalate further on older 4.x lines — which is exactly why "we only have trusted admins" is not a remediation strategy when those admin sessions can be phished. Headless Strapi shows up behind marketing sites, customer portals, and internal content tools. If you still run anything below 4.8.0 in production, this week is a forced upgrade — not a backlog ticket.
What to patch and how to verify
Upgrade production and staging to Strapi 4.8.0 or a currently maintained 4.x/5.x line your app supports. Re-run database migrations in a clone first. After deploy, confirm the admin and API containers report the expected version. Review reverse-proxy logs for filter query parameters targeting fields like email, password, and reset-token around the period before you patched. Rotate password-reset secrets and consider forcing password resets for admin users if you see suspicious filter traffic.
# Confirm Strapi version in each environment
rg -n '"@strapi/strapi"' package.json yarn.lock package-lock.json
# After upgrade
npm ls @strapi/strapi
# Hunt suspicious filters in access logs (pattern sketch)
rg -n 'filters|password|resetPasswordToken' /var/log/nginx/*.logHardening beyond the version bump
Restrict admin-panel exposure with SSO, IP allowlists, or a VPN. Disable unused plugin routes. Ensure private fields cannot be queried from non-admin APIs. Add an alert when admin filter queries reference sensitive attributes. Document the CVE ID, prior version, new version, and log-review window for customer security questionnaires.
Founder takeaway
CVE-2023-22894 is now in CISA KEV with an October 11, 2026 due date. Upgrade Strapi below 4.8.0 immediately, review admin filter logs for private-field probing, and tighten admin exposure. Headless CMS is still production infrastructure — treat it like your primary API when CISA says exploitation is known.
Why old CMS CVEs return as incidents
CVE-2023-22894 is not a brand-new zero-day. It is an older disclosure that CISA has now marked as known exploited. That pattern — Flax Typhoon-related KEV waves in early October 2026 also pulled in aged ProFTPD, BIND, Struts, and ONLYOFFICE issues — is a reminder that forgotten admin panels are inventory problems. Strapi instances spun up for a marketing redesign in 2023 and never upgraded are exactly what automated exploit kits love.
Map every Strapi to an owner. Include preview environments with production data copies. If a contractor still has an admin invite on an old URL, revoke it as part of the patch window. SSO on the admin panel beats shared passwords stored in a 1Password vault titled "cms."
Upgrade notes that save Saturday nights
Major Strapi upgrades can touch content-type schemas and plugin APIs. Do not jump versions only in production. Restore a backup into a throwaway environment, run the upgrade, click through admin critical paths (login, publish, media library, custom plugins), then promote. If you are many minors behind, read the migration guides between your version and 4.8.0 instead of hoping npm install is enough.
Add monitoring for admin authentication anomalies and for query strings that reference private user fields. Ship the CVE response note to customers who ask about your CMS posture. If Strapi is only used internally, still patch — internal tools are how lateral movement starts.
Pair this work with a short architecture decision: stay on Strapi and commit to a quarterly upgrade cadence, or migrate content to a hosted CMS with a clearer patch SLA. Either choice beats discovering KEV entries from a customer's CISO email.
Operationally, treat this topic as a dated workstream with a named owner, a written success check, and a short note you can reuse in customer security or procurement reviews. Prefer primary sources linked in your engineering channel over secondary summaries. If you cannot point to the advisory, policy table, or vendor post that justifies the change, you are not ready to claim readiness.
Share the plan with support and sales early. The expensive failure mode is not the code change — it is a surprise store rejection, a customer questionnaire gap, or a checkout path that marketing already promoted. A one-page internal brief beats a Slack thread nobody can find a month later.
Operationally, treat this topic as a dated workstream with a named owner, a written success check, and a short note you can reuse in customer security or procurement reviews. Prefer primary sources linked in your engineering channel over secondary summaries. If you cannot point to the advisory, policy table, or vendor post that justifies the change, you are not ready to claim readiness.
Share the plan with support and sales early. The expensive failure mode is not the code change — it is a surprise store rejection, a customer questionnaire gap, or a checkout path that marketing already promoted. A one-page internal brief beats a Slack thread nobody can find a month later.
Operationally, treat this topic as a dated workstream with a named owner, a written success check, and a short note you can reuse in customer security or procurement reviews. Prefer primary sources linked in your engineering channel over secondary summaries. If you cannot point to the advisory, policy table, or vendor post that justifies the change, you are not ready to claim readiness.
Share the plan with support and sales early. The expensive failure mode is not the code change — it is a surprise store rejection, a customer questionnaire gap, or a checkout path that marketing already promoted. A one-page internal brief beats a Slack thread nobody can find a month later.
