NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

CVE-2023-48218 — strapi-plugin-protected-p…

MEDIUMFix: strapi-community/strapi-plugin-protected-populate@0544106

CVE-2023-48218 is a medium-severity (CVSS 5.3) CWE-863 vulnerability in strapi-plugin-protected-populate. A fix is available for strapi-plugin-protected-populate — see the affected versions and patch details below.

Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable

Also known asGHSA-6h67-934r-82g7
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 1, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.6%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs49th percentile — riskier than 49% of all scored CVEsHighest risk
0.00%0.37%0.73%1.10%0.3%0.6%May 26Aug 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
strapi-plugin-protected-populatenpm
201downloads / week

Description

The Strapi Protected Populate Plugin protects get endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmstrapi-plugin-protected-populateall versions1.3.4npm install strapi-plugin-protected-populate@1.3.4

Affected Products

1 product · 1 configurations
Application
protected populatestrapi
< 1.3.4
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for strapi-plugin-protected-populate, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update strapi-plugin-protected-populate to 1.3.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-48218 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.
O3 Security · Impact-Aware SCA

Is CVE-2023-48218 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2023-48218: strapi-plugin-protected-p… — Fixed in 1.3.4