GHSA-7mqx-wwh4-f9fw
NoneCVSS
—
EPSS
—
Published
May 13, 2026
CISA due date
—
The record
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @strapi/plugin-users-permissions | 0 | 5.45.0 |
Related vulnerabilities
- CVE-2025-64526 Strapi is an open source headless content management system. Same vulnerability
- CVE-2026-22706 Strapi is an open source headless content management system. Also affects @strapi/plugin-users-permissions
- GHSA-hvp3-26wx-g2w4 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions Also affects @strapi/plugin-users-permissions
- CVE-2026-89174 Smart Video Intercom System developed by Kingdom Communication Associated has a Missing… CWE-307
- CVE-2026-88770 A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and… CWE-307
- CVE-2026-78490 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-307
- CVE-2026-86729 WWBN AVideo through commit e01e41ecc (no patched version available) exposes… CWE-307
- CVE-2026-20514 In Audio HAL, there is a possible information disclosure due to a missing permission… CWE-307