CVE Tools
Sign in
Back to feed
Research Strapi auth-bypass web-app

CVE-2026-27886: Unauthenticated Boolean-Oracle Exfiltration of Administrator Secrets in Strapi

Bishop Fox·By Nate Robb··18 min read
TL;DR

Bishop Fox confirmed CVE-2026-27886, a critical sanitization bypass in Strapi 4.0.0 through 5.36.1 that lets an unauthenticated attacker read administrator data and seize the most privileged account on the system. Shodan currently surfaces the CMS on over 20,000 internet-facing hosts. The bug turns a normal-looking API request into a one-bit oracle that leaks an admin's password-reset token character by character, which can then be used through Strapi's normal forgot-password endpoint to take over the account and return a Super Admin session. The traffic profile looks like ordinary API browsing, and the bracket-syntax filter at the heart of the bug is not flagged by default WAF rule sets.

Strapi shipped the fix in version 5.37.0 on February 26, 2026, and the advisory followed on May 13, 2026; administrators running anything older should upgrade, rotate admin credentials, and invalidate outstanding password-reset tokens.…

Continue reading on Bishop Fox

Related coverage

Other stories on the same CVEs
No other coverage for these CVEs yet.
Worried this affects your company?

See what your business actually exposes to the Internet — a free external review, no install, no obligation.

Check my exposure