Strapi’s users‑permissions plugin imposed rate limits on authentication endpoints by including the email field from the request body in the rate‑limit key. Because the key was constructed even on endpoints that do not accept an email, an unauthenticated sender could supply a unique email per request. This would produce a new key for each call, effectively negating per‑IP throttling and allowing the attacker to perform credential brute‑force, password‑reset code abuse, or credential‑stuffing against the CMS.

Affected are installations of Strapi, specifically the strapi plugin‑users‑permissions component, running any version earlier than 5.45.0. Users of Strapi v5.44.x or older may be subject to the bypass on routes such as /auth/local, /auth/reset‑password, and /auth/change‑password.

With a CVSS base score of 6.9, the vulnerability presents moderate severity. The absence of an EPSS rating indicates no publicly observed exploitation yet, but the lack of a KEV listing does not eliminate the threat. An attacker can exploit the flaw by sending specially crafted POST requests that include a unique email address to the targeted authentication endpoints, thereby resetting the rate‑limit key on each attempt. If the CMS is exposed to the public internet, the ability to bypass throttling may result in successful credential attacks, elevating the likelihood of data compromise.