Unauthorized Access to Private Fields in User Registration API
System Details
| Name | Value |
|---|---|
| OS | Windows 11 |
| Version | 4.11.1 (node v16.14.2) |
| Database | mysql |
Description
I marked some fields as private fields in user content-type, and tried to register as a new user via api, at the same time I added content to fill the private fields and sent a post request, and as you can see from the images below, I can write to the private fields.
To prevent this, I went to the extension area and tried to extend the register method, for this I wanted to do it using the sanitizeInput function that I know in the source codes of the strap. But the sanitizeInput function did not filter out private fields.
const { auth } = ctx.state;
const data = ctx.request.body;
const userSchema = strapi.getModel("plugin::users-permissions.user");
sanitize.contentAPI.input(data, userSchema, { auth });here's the solution I've temporarily kept to myself, code snippet
const body = ctx.request.body;
const { attributes } = strapi.getModel("plugin::users-permissions.user");
const sanitizedData = _.omitBy(body, (data, key) => {
const attribute = attributes[key];
if (_.isNil(attribute)) {
return false;
}
//? If you want, you can throw an error for fields that we did not expect.
// if (_.isNil(attribute))
// throw new ApplicationError(`Unexpected value ${key}`);
// if private value is true, we do not want to send it to the database.
return attribute.private;
});
return sanitizedData;Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @strapi/plugin-users-permissions | >= 4.0.0, < 4.13.1 | 4.13.1 |
| npm package | @strapi/strapi | >= 4.0.0, < 4.13.1 | 4.13.1 |
References
- CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L- Weakness (CWE)
CWE-287- Platform
- npm
- Package
@strapi/plugin-users-permissions, @strapi/strapi- Disclosed
- 03.11.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-gc7p-j5xm-xxh2 - CC BY 4.0
Vulnerability history: @strapi/plugin-users-permissions
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 04.2023 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 4
- Medium 2
- Low 1
Disclosures per year
- 2023: 5
- 2024: 1
- 2025: 0
- 2026: 2
-
Unauthorized Access to Private Fields in User Registration API this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.