Description
Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Version 11.13.0 fixes the issue.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/directus/directus/security/advisories/GHSA-8jpw-gpr4-8cmh
Scores
CVSS v3
6.5
EPSS
0.0024
EPSS Percentile
15.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-201
Status
published
Products (3)
directus/api
0 - 32.0.0npm
monospace/directus
< 11.13.0
npm/directus
0 - 11.13.0npm
Published
Nov 13, 2025
Tracked Since
Feb 18, 2026