Loading story…
Strapi disclosed CVE-2026-27886, a critical query-sanitization bypass affecting @strapi/strapi versions 4.0.0 through 5.36.1 that allowed unauthenticated attackers to leak sensitive administrator data from public Content API endpoints. The flaw let crafted top-level and relational filter parameters such as where[updatedBy] reach the database layer, where response-count differences in meta.pagination.total created a boolean oracle against private fields in the joined admin_users table. Researchers said attackers could recover values including administrator email addresses and resetPasswordToken data one character at a time, provided the target exposed at least one publicly readable collection linked to an admin account through updated_by_id or created_by_id.
By combining the oracle with Strapi's unauthenticated /admin/forgot-password and /admin/reset-password flows, an attacker could recover a 40-character reset token and obtain a Super Admin JWT without user interaction, resulting in full administrative takeover. Strapi fixed the issue in 5.37.0 and described new sanitization controls that block unsafe query-parameter chains before execution, while Bishop Fox published technical details and a detection tool for identifying exposed instances. Defenders were advised to upgrade immediately, rotate administrator passwords, invalidate outstanding reset tokens, and review logs for indicators such as repeated where probes against admin-related fields, iterative hex-character guessing from a single IP, and unexpected password-reset activity.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub pull request to ProjectDiscovery's nuclei-templates repository introduced a Nuclei template for CVE-2026-27886 that performs differential checks and brute-forces Strapi admin email and resetPasswordToken values character by character. The template was validated against a Strapi 5.36.1 lab instance and updated with corrected scoring and metadata.
Bishop Fox published technical analysis confirming that CVE-2026-27886 can be chained with Strapi's unauthenticated forgot-password and reset-password endpoints to recover an admin reset token and obtain a Super Admin JWT. The company also released a detection tool for identifying vulnerable instances without completing account takeover and advised password rotation and token invalidation.
Strapi publicly disclosed CVE-2026-27886 as a critical vulnerability with a CVSS score of 9.3, explaining that unauthenticated attackers could use public Content API endpoints as a boolean oracle to leak admin data and potentially take over accounts. The advisory also shared indicators of compromise and noted fixed versions were available.
Strapi remediated a critical query-parameter sanitization flaw affecting versions 4.0.0 through 5.36.1 by releasing version 5.37.0. The patch tightened query sanitization and blocked unsafe relational filtering paths that could expose administrator secrets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcebishopfox.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A mass disclosure detailed **11 vulnerabilities** in **Grav CMS** and the **`getgrav/grav-plugin-api`** package, with the most severe issues affecting the API plugin before **`1.0.13`** and Grav CMS before **`2.0.13`**. Multiple API endpoints failed to enforce API key scope caps or relied on bare `isSuperAdmin()` checks instead of scope-aware permission validation, allowing least-privilege or narrowly scoped keys to perform privileged actions. Reported impacts include creating unrestricted API keys (`CVE-2026-72826`), promoting users or invited accounts to super-admin (`CVE-2026-72828`, `CVE-2026-72829`, `CVE-2026-72833`), and disabling 2FA for non-super accounts without a TOTP code via `POST /api/v1/users/{user}/2fa/disable` (`CVE-2026-72822`). The disclosure also included several paths to **remote code execution**. In the API plugin, `CVE-2026-72830` allows attackers with `api.config.write` access to alter scheduler settings and inject commands through `scheduler.custom_jobs`, while `CVE-2026-72824` can enable Twig processing during page saves and lead to server-side template injection under certain settings. In core Grav CMS, `CVE-2026-72819` allows authenticated users to upload a malicious ZIP through Flex Objects and write PHP files to the web root, and `CVE-2026-72827` enables Twig injection through email-action parameters that can execute OS commands when forms are submitted. Advisories recommend upgrading to **Grav `2.0.13`** and **API plugin `1.0.13`**, rotating API keys, and auditing super-admin accounts, invitations, scheduler jobs, and 2FA settings; no active exploitation was reported at publication time.
Aug 19, 2026
Red Hat and the Keycloak project patched **CVE-2026-18963**, a critical flaw in the `keycloak-services` component that allows an unauthenticated remote attacker to take over arbitrary accounts, including administrators. The vulnerability affects the password recovery process: improper state validation in the reset-credentials flow lets a crafted request bypass the normal email verification or action-token step and proceed directly to changing a user's password. Red Hat assigned the issue a **CVSS 9.1** score and classified it as **CWE-640**. Affected versions include upstream Keycloak releases earlier than **26.7.2** and Red Hat Build of Keycloak versions earlier than **26.4.15** and **26.6.6**. Red Hat and CERT-PY urged organizations to apply the available security updates, while Red Hat also published a temporary mitigation for environments that cannot patch immediately by disabling the **"Forgot password"** feature across all realms. A Nuclei template pull request was also opened to detect the issue, underscoring rapid defender interest, although no verified public exploit or confirmed in-the-wild exploitation had been reported at publication time.
Aug 31, 2026
Pimcore disclosed and fixed **CVE-2026-55207**, an account takeover flaw in the password reset workflow that can let an unauthenticated attacker hijack any administrator account and bypass **2FA**. The issue stems from insufficient validation of a user-supplied `resetPasswordUrl`: if an attacker knows a valid admin username, they can trigger a password reset that sends a legitimate recovery token to attacker-controlled infrastructure. If the targeted user clicks the emailed link, the attacker can capture the token and authenticate through the ` /pimcore-studio/api/login/token ` endpoint with full administrative privileges. The vulnerability affects Pimcore versions before **2025.4.6** and versions **2026.1.0** through before **2026.1.6**. Pimcore addressed the issue in **2025.4.6** and **2026.1.6**; the latter release notes explicitly mention **reset password URL validation** among the security-relevant changes. The flaw is tracked as **CVE-2026-55207**, mapped to **CWE-640**, and carries a high-severity **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`.
Jul 10, 2026