{"action":"Upgrade @strapi/plugin-users-permissions to 5.45.0 or later.","affected":[{"fixed":"5.45.0","introduced":"0"}],"component":"@strapi/plugin-users-permissions","cve_ids":["CVE-2025-64526"],"ecosystem":"npm","epss":0.00492,"exploited":false,"fixed_versions":["5.45.0"],"ghsa_id":"GHSA-7mqx-wwh4-f9fw","id":"tcs_01M5KFAE5JRTT7APDB8HRZ9AXA","modified_at":"2026-05-16T00:05:28.260538Z","published_at":"2026-05-13T20:02:15Z","references":["https://osv.dev/vulnerability/GHSA-7mqx-wwh4-f9fw","https://github.com/strapi/strapi/security/advisories/GHSA-7mqx-wwh4-f9fw","https://nvd.nist.gov/vuln/detail/CVE-2025-64526","https://github.com/strapi/strapi/pull/24818","https://github.com/strapi/strapi/commit/5e0d243cba9830e6f791de6a94798bcde51468db","https://github.com/strapi/strapi","https://github.com/strapi/strapi/releases/tag/v5.45.0"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-7mqx-wwh4-f9fw","url":"https://osv.dev/vulnerability/GHSA-7mqx-wwh4-f9fw"},{"source":"nvd","source_id":"CVE-2025-64526","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64526"}],"summary":"Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying"}