CORS Misconfiguration Vulnerability in Strapi Content Management System

CVE-2025-53092

What is CVE-2025-53092?

A configuration flaw in Strapi, an open-source headless content management system, allows improper handling of Cross-Origin Resource Sharing (CORS). In default installations prior to version 5.20.0, the system reflects the value of the Origin header back in the Access-Control-Allow-Origin response without adequate validation or a whitelist. This oversight permits an attacker-controlled site to make credentialed requests to the Strapi API, potentially leading to unauthorized access. The issue is corrected in version 5.20.0, and no known workarounds are available.

References