CVE-2026-22706— Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Quick assessment
Affected
strapi strapi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Strapi是法国strapi社区的一套开源的内容管理系统（CMS）。 Strapi 5.33.3之前版本存在代码问题漏洞，该漏洞源于更改或重置用户密码时未默认使现有刷新令牌会话失效，可能导致先前获取刷新令牌的攻击者在合法用户重置密码后继续生成新的访问令牌，实现持久未授权访问。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| strapi | @strapi/admin | < 5.33.3 |
affected |
| strapi | @strapi/plugin-users-permissions | < 5.33.3 |
affected |
| strapi | strapi | < 5.33.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-22706
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Source: CVE Program / CVE List V5
Vulnerability Description
Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure. The patch in version 5.33.3 invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Vulnerability Title
Strapi 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Strapi是法国strapi社区的一套开源的内容管理系统（CMS）。 Strapi 5.33.3之前版本存在代码问题漏洞，该漏洞源于更改或重置用户密码时未默认使现有刷新令牌会话失效，可能导致先前获取刷新令牌的攻击者在合法用户重置密码后继续生成新的访问令牌，实现持久未授权访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| strapi | strapi | < 5.33.3 | - |
|
| strapi | @strapi/admin | < 5.33.3 | - |
|
| strapi | @strapi/plugin-users-permissions | < 5.33.3 | - |
|
II. Public POCs for CVE-2026-22706
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22706
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-22706 (1)
Same Patch Batch · strapi · 2026-05-14 · 5 CVEs total
| CVE-2026-22707 | Strapi Upload Plugin MIME Validation Bypass via Content API | |
| CVE-2026-22599 | Strapi Vulnerable to SQL Injection in Content Type Builder | |
| CVE-2026-27886 | Strapi may leak sensitive data via relational filtering due to lack of query sanitization | |
| CVE-2025-64526 | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email k |
IV. Related Vulnerabilities
Same product: strapi
-
CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS v -
CVE-2026-57997
Strapi users-permissions - JWT Algorithm Confusion via Missi -
CVE-2026-27886
Strapi may leak sensitive data via relational filtering due -
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API -
CVE-2026-22599
Strapi Vulnerable to SQL Injection in Content Type Builder
Same vendor: strapi
-
CVE-2026-90561
Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS v -
CVE-2026-57997
Strapi users-permissions - JWT Algorithm Confusion via Missi -
CVE-2026-27886
Strapi may leak sensitive data via relational filtering due -
CVE-2026-22707
Strapi Upload Plugin MIME Validation Bypass via Content API -
CVE-2026-22599
Strapi Vulnerable to SQL Injection in Content Type Builder
Same weakness: CWE-613
-
CVE-2026-88805
Session Not Revoked Server-Side on Logout in Rancher -
CVE-2026-100711
froxlor before 2.3.12 Authentication Bypass via Session Pers -
CVE-2026-100624
Capgo.app before 12.264.5 Upload Expiry Bypass via build upl -
CVE-2026-100554
OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass -
CVE-2026-100502
Flame through 2.4.0 Admin Token Insufficient Session Expirat
V. Comments for CVE-2026-22706
No comments yet