
Strapi CVE-2026-27886. Leaking sensitive data via relational filtering due to lack of query sanitization
For authorized security testing only.
Strapi leaking sensitive data via relational filtering due to lack of query sanitization.
Includes:
CVE-2026-27886.py - Python PoCCVE-2026-27886.yaml - Nuclei template for detectionThe checker sends two requests to a public Strapi Content API collection endpoint:
GET /api/<collection>
GET /api/<collection>?where[id][$lt]=-1
If the baseline response has records and the false where predicate collapses the result set to zero, the endpoint is likely vulnerable.
Safe check:
python3 CVE-2026-27886.py http://strapi/api/articles
Field enumeration:
python3 CVE-2026-27886.py http://strapi/api/articles --enum-fields
nuclei -t CVE-2026-27886.yaml -u http://strapi/api/articles