CVE-2025-53092

Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.

Affected

strapi

CVSS v3.1 GITHUB

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVSS v3.1 GitHub

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.29% chance of exploitation in the next 30 days, 20th percentile

Published

2025-10-16

Proof-of-concept exploits (1)

• XdropAgent2/maganghub-cors-poc0★ · 2026-07-16

Security advisories

• strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8
• advisories/GHSA-9329-mxxw-qwf8

References

• CVE Record
• NVD entry