{"id":"CVE-2026-22706","sourceIdentifier":"security-advisories@github.com","published":"2026-05-14T19:16:30.700","lastModified":"2026-10-26T14:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure. The patch in version 5.33.3 invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response."},{"lang":"es","value":"Strapi es un sistema de gestión de contenido headless de código abierto. En versiones de Strapi anteriores a la 5.33.3, cambiar o restablecer la contraseña de un usuario no invalidaba las sesiones de refresh-token existentes del usuario por defecto. El paso de invalidación del refresh-token en los controladores de autenticación de usuarios-permisos y de administrador era condicional a un ’deviceId’ proporcionado por el llamador. Cuando una solicitud de cambio o restablecimiento de contraseña no incluía un ’deviceId’, no se revocaban los refresh tokens, dejando activa cada sesión anterior. Un atacante que había obtenido previamente un refresh token podía continuar generando nuevos access tokens después de que el usuario legítimo restableciera su contraseña, permitiendo un acceso no autorizado persistente durante la vida útil del refresh token (hasta 30 días por defecto). La rotación de credenciales ya no terminaba una sesión de atacante activa, frustrando el restablecimiento de contraseña como medida de contención. El parche en la versión 5.33.3 invalida todos los refresh tokens asociados con el usuario en cada cambio y restablecimiento de contraseña, independientemente de si se proporciona un ’deviceId’. Una nueva sesión con ámbito de dispositivo se emite entonces al llamador como parte de la respuesta."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"strapi","product":"strapi","versions":[{"version":"< 5.33.3","status":"affected"}]},{"vendor":"strapi","product":"@strapi/admin","versions":[{"version":"< 5.33.3","status":"affected"}]},{"vendor":"strapi","product":"@strapi/plugin-users-permissions","versions":[{"version":"< 5.33.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-15T14:50:52.300520Z","id":"CVE-2026-22706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*","versionEndExcluding":"5.33.3","matchCriteriaId":"FD0D7690-E4F7-4636-8C0C-52C992F905C6"}]}]}],"references":[{"url":"https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}