CVE-2025-53092: Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
Summary
A CORS misconfiguration vulnerability exists in default installations of Strapi where attacker-controlled origins are improperly reflected in API responses.
Technical Details
By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting.
Example: Origin: http://localhost:8888 Access-Control-Allow-Origin: http://localhost:8888 Access-Control-Allow-Credentials: true
This allows an attacker-controlled site (on a different port, like 8888) to send credentialed requests to the Strapi backend on 1337.
Suggested Fix
1. Explicitly whitelist trusted origins 2. Avoid reflecting dynamic origins
Other sources
Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53092?
CVE-2025-53092 is considered a high severity vulnerability due to its potential impact on CORS misconfigurations.
How do I fix CVE-2025-53092?
To fix CVE-2025-53092, upgrade Strapi to version 5.20.0 or later to mitigate the CORS misconfiguration.
What is the primary vulnerability in CVE-2025-53092?
The primary vulnerability in CVE-2025-53092 is a CORS misconfiguration that reflects the Origin header value in the Access-Control-Allow-Origin response.
Which versions of Strapi are affected by CVE-2025-53092?
Strapi versions prior to 5.20.0 are affected by CVE-2025-53092.
What are the risks associated with CVE-2025-53092?
The risks associated with CVE-2025-53092 include unauthorized cross-origin requests that could compromise data security.