{"id":"EUVD-2025-34775","enisaUuid":"a024bd21-1225-3d51-a3f3-13c2a819fd07","description":"Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.","datePublished":"Oct 16, 2025, 4:29:35 PM","dateUpdated":"Oct 16, 2025, 6:13:08 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","references":"https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8\n","aliases":"CVE-2025-53092\nGHSA-9329-mxxw-qwf8\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"0e47a66a-b244-3125-8c57-6f7c670258c4","product":{"name":"Strapi","vendor":{"name":"strapi"}},"product_version":"\u003c 5.20.0"}],"enisaIdVendor":[{"id":"4c027b39-4778-3f72-adcf-4bcbc23b788c","vendor":{"name":"strapi"}}],"enisaIdVulnerability":[{"id":"89ddafd7-0296-33a6-bee1-48fc739b443b","vulnerability":{"id":"GHSA-9329-mxxw-qwf8","description":"Strapi core vulnerable to sensitive data exposure via CORS misconfiguration","datePublished":"Oct 16, 2025, 7:49:01 PM","dateUpdated":"Jan 29, 2026, 3:59:42 AM","baseScore":0.0,"references":"https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-53092\nhttps://github.com/strapi/strapi/commit/6e535cb756\nhttps://github.com/strapi/strapi\nhttps://github.com/strapi/strapi/releases/tag/v5.20.0\n","enisa_id":"EUVD-2025-34775\n","aliases":"GHSA-9329-mxxw-qwf8\nCVE-2025-53092\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a90b76af-a457-3822-bcdc-911596c32a38","vulnerability":{"id":"CVE-2025-53092","description":"Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.","datePublished":"Oct 16, 2025, 4:29:35 PM","dateUpdated":"Oct 16, 2025, 6:13:08 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","references":"https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8\n","enisa_id":"EUVD-2025-34775\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 1, 2026, 1:37:48 AM","vulnerabilityProduct":[{"id":"cf318150-40c0-3825-9243-40a33ac5f06f","product":{"name":"Strapi","vendor":{"name":"strapi"}},"product_version":"\u003c 5.20.0"}],"vulnerabilityVendor":[{"id":"a92404e0-9af1-3276-bb17-23bae46201a1","vendor":{"name":"strapi"}}]}}],"enisaIdAdvisory":[]}