CVE-2026-27886

Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` (or other admin-relation) field to perform a boolean-oracle attack against private fields on the joined `admin_users` table, including the `resetPasswordToken` field. Extracting an admin reset token via this oracle made full administrative account takeover possible without authentication. When a filter such as `where[updatedBy][resetPasswordToken][$startsWith]=a` was applied to a public Content API endpoint, the underlying query generation performed a `LEFT JOIN` against the `admin_users` table and emitted a `WHERE` clause referencing the joined column. The query parameter sanitization layer did not block operator chains that traversed into relational target schemas the caller had no read permission on, allowing the response count to be used as a one-bit oracle on any admin-table field. The patch in version 5.37.0 introduces explicit query-parameter sanitization at the controller and service boundary via three new primitives: `strictParam`, `addQueryParams`, and `addBodyParams`. Operator chains that traverse into restricted relational targets are now rejected before reaching the database.

• CWE-22
• CWE-200
• CWE-943

• https://github.com/strapi/strapi/security/advisories/GHSA-rjg2-95x7-8qmxVendor Advisory

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27880The OpenFeature feature toggle evaluation endpoint reads unb…7.5
• CVE-2026-27881Coolify is an open-source and self-hostable tool for managin…5
• CVE-2026-27882Coolify is an open-source and self-hostable tool for managin…4.8
• CVE-2026-27883Coolify is an open-source and self-hostable tool for managin…5
• CVE-2026-27884NetExec is a network execution tool. Prior to version 1.5.1,…5.3
• CVE-2026-27885Piwigo is an open source photo gallery application for the w…7.2
• CVE-2026-27887Spin is an open source developer tool for building and runni…6.9
• CVE-2026-27888pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2026-27889NATS-Server is a High-Performance server for NATS.io, a clou…7.5
• CVE-2026-2789Use-after-free in the Graphics: ImageLib component. This vul…9.8
• CVE-2026-27890Firebird is an open-source relational database management sy…8.2
• CVE-2026-27891FacturaScripts is an open source accounting and invoicing so…7.2