@strapi/plugin-users-permissions

npm · Package

8 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypassCVE-2024-34065 · GHSA-WRVH-RCMR-9QFC	@strapi/plugin-users-permissions	npm	High	Fix reported	2026-09-10
Strapi Improper Rate Limiting vulnerabilityCVE-2023-38507 · GHSA-24Q2-59HM-RH9R	@strapi/admin @strapi/plugin-users-permissions	npm	High	Fix reported	2026-09-10
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingCVE-2025-64526 · GHSA-7MQX-WWH4-F9FW	@strapi/plugin-users-permissions	npm	Medium	Fix reported	2026-05-16
Strapi: Password Reset Does Not Revoke Existing Refresh SessionsCVE-2026-22706 · GHSA-HVP3-26WX-G2W4	@strapi/admin @strapi/plugin-users-permissions	npm	Low	Fix reported	2026-05-16
Strapi does not verify the access or ID tokens issued during the OAuth flowCVE-2023-22893 · GHSA-583X-23H9-F5W7	@strapi/plugin-users-permissions	npm	Medium	Fix reported	2023-11-08
Unauthorized Access to Private Fields in User Registration APICVE-2023-39345 · GHSA-GC7P-J5XM-XXH2	@strapi/plugin-users-permissions @strapi/strapi	npm	High	Fix reported	2023-11-08
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions PluginCVE-2023-22621 · GHSA-2H87-4Q2W-V4HF	@strapi/plugin-email @strapi/plugin-users-permissions	npm	Critical	Fix reported	2023-11-08
Authentication Bypass in @strapi/plugin-users-permissionsGHSA-XV3Q-JRMM-4FXV	@strapi/plugin-users-permissions	npm	High	Fix reported	2023-04-19