CVE-2022-30617 (strapi)

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “authorâ€� role account can view these details in the JSON response for an “editorâ€� or “super adminâ€� that has updated one of the author’s blog posts. There are also many other scenarios …

cve cve-2022-30617 strapi