CVE-2024-56143

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2024-56143

EUVD

EUVD-2024-55037

Affected Vendors & Products

Vendor	Product	Version / Range
strapi	strapi	From 5.0.0 (inc) to 5.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Strapi versions 5.0.0 to before 5.5.2 involves improper sanitization of query parameters for private fields in the lookup operator of the document service. An attacker can exploit this by crafting queries that access private fields, such as admin passwords and reset tokens, which should normally be protected.

Impact Analysis

The vulnerability allows an attacker to access sensitive private information like admin passwords and reset tokens without authorization. This can lead to unauthorized access to the system, potential account takeover, and compromise of the integrity and confidentiality of the data managed by Strapi.

Mitigation Strategies

Upgrade Strapi to version 5.5.2 or later, as this version contains the fix for the vulnerability that allows unauthorized access to private fields via the lookup operator.

Hi! I’m here to help you understand CVE-2024-56143. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70