GHSA-hvp3-26wx-g2w4
NoneCVSS
—
EPSS
—
Published
May 13, 2026
CISA due date
—
The record
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @strapi/admin | 0 | 5.33.3 |
| npm | @strapi/plugin-users-permissions | 0 | 5.33.3 |
Related vulnerabilities
- CVE-2026-22706 Strapi is an open source headless content management system. Same vulnerability
- CVE-2025-64526 Strapi is an open source headless content management system. Also affects @strapi/plugin-users-permissions
- GHSA-7mqx-wwh4-f9fw Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email… Also affects @strapi/plugin-users-permissions
- CVE-2026-55250 Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0… CWE-613
- CVE-2026-86215 A vulnerability was identified in Mstfakts College-Management-System. CWE-613
- CVE-2026-55513 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-613
- CVE-2026-61608 SolidInvoice is an open-source invoicing platform. CWE-613
- CVE-2026-84480 WWBN AVideo fails to validate password recovery token expiration in… CWE-613