---
id: 3818
title: "CVE-2026-27886: Unauthenticated Boolean-Oracle Exfiltration of Administrator Secrets in Strapi"
cve: CVE-2026-27886
cvss: 7.5
severity: high
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/cve-2026-27886-unauthenticated-boolean-oracle-exfiltration-of-administrator-secrets-in-strapi"
published_at: "2026-05-22 00:00"
tags: ["vulnerability-research", "access-control", "account-takeover", "information-disclosure", "strapi", "cve-2026-27886", "oracle-attack", "sanitization-bypass"]
phying_url: "https://phying.com/item/3818"
lang: en
---

# CVE-2026-27886: Unauthenticated Boolean-Oracle Exfiltration of Administrator Secrets in Strapi

## Summary

CVE-2026-27886 is a Strapi 4.0.0–5.36.1 sanitization bypass that turns API responses into a one-bit oracle; attackers extract an admin's reset token character by character, then take over the account.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2026-27886
- **CVSS:** 7.5
- **Published:** 2026-05-22 00:00
- **Original:** https://bishopfox.com/blog/cve-2026-27886-unauthenticated-boolean-oracle-exfiltration-of-administrator-secrets-in-strapi
- **Phying News:** https://phying.com/item/3818