{"id":"CVE-2024-56143","aliases":["GHSA-495j-h493-42q2"],"url":"https://o3.security/vulnerability/CVE-2024-56143","summary":"Strapi Allows Unauthorized Access to Private Fields via parms.lookup","details":"### Summary\nIt's possible to access any private fields by filtering through the lookup parameters\n\n### Details\n\nUsing the new lookup operator provided by the document service in Strapi 5, it is not properly sanitizing this query operator for private fields.\n\n### PoC\n\n1. Create a strapi app.\n2. Create a content-type\n3. In the content-type you make a new entry\n4. Go back to the list view\n4. Add `&lookup[updatedBy][password][$startsWith]=$2` to the end of your url (All passwords start with $2) see that all entries are still there\n6. Add `&lookup[updatedBy][password][$startsWith]=$3` see the entry disappear proving that the search above works\n\n### Impact\n\nAn attacker can perform filtering attacks on everything related to the object, including admin passwords and reset-tokens. This means that they can gain full access to the strapi instance.","published":"2025-10-16T16:07:30.996Z","modified":"2026-08-12T03:51:37.285036303Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@strapi/core","fixedVersion":"5.5.2"}],"fix":{"url":"https://github.com/strapi/strapi/commit/0c6e0953ae1e62afae9329de7ae6d6a5e21b95b8","label":"strapi/strapi@0c6e095"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56143.json"},{"type":"ADVISORY","url":"https://github.com/strapi/strapi/security/advisories/GHSA-495j-h493-42q2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56143"},{"type":"FIX","url":"https://github.com/strapi/strapi/commit/0c6e0953ae1e62afae9329de7ae6d6a5e21b95b8"},{"type":"PACKAGE","url":"https://github.com/strapi/strapi"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.285036303Z"}}