CORS Misconfiguration Vulnerability in Strapi Content Management System

CVE-2025-53092

What is CVE-2025-53092?

A configuration flaw in Strapi, an open-source headless content management system, allows improper handling of Cross-Origin Resource Sharing (CORS). In default installations prior to version 5.20.0, the system reflects the value of the Origin header back in the Access-Control-Allow-Origin response without adequate validation or a whitelist. This oversight permits an attacker-controlled site to make credentialed requests to the Strapi API, potentially leading to unauthorized access. The issue is corrected in version 5.20.0, and no known workarounds are available.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References