Improper access control in strapi - CVE-2024-56143
Published: April 23, 2026
Vulnerability identifier: #VU126968
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-56143
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in the parms.lookup query operator when processing lookup filter parameters for private fields. A remote attacker can send a specially crafted lookup query to disclose sensitive information.
The issue can be used to perform filtering attacks against private fields, including admin passwords and reset tokens.
Affected software
strapi
How to mitigate CVE-2024-56143
Install security update from vendor's website.
strapi - update to 5.5.2