{"action":"Upgrade strapi-plugin-protected-populate to 1.3.4 or later.","affected":[{"fixed":"1.3.4","introduced":"0"}],"component":"strapi-plugin-protected-populate","cve_ids":["CVE-2023-48218"],"ecosystem":"npm","epss":0.00601,"exploited":false,"fixed_versions":["1.3.4"],"ghsa_id":"GHSA-6h67-934r-82g7","id":"tcs_01M5KF737MDCQE3YJX28J5HEPN","modified_at":"2026-09-10T03:50:04.151489371Z","published_at":"2023-11-20T21:01:43Z","references":["https://osv.dev/vulnerability/GHSA-6h67-934r-82g7","https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7","https://nvd.nist.gov/vuln/detail/CVE-2023-48218","https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39","https://github.com/strapi-community/strapi-plugin-protected-populate","https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-6h67-934r-82g7","url":"https://osv.dev/vulnerability/GHSA-6h67-934r-82g7"}],"summary":"Bypass of field access control in strapi-plugin-protected-populate"}