Executive brief
Directus is a popular headless CMS and API-first platform used to manage and deliver content. A privilege escalation flaw in the Share feature allows users with lower permissions to artificially elevate their access by specifying an arbitrary role when sharing items, potentially exposing sensitive fields and data they should not be able to view.
Technical details
The vulnerability is a privilege management flaw (CWE-269) in the Share feature where role assignment is not properly restricted. Non-admin users can specify an arbitrary role when creating a share link to an item, allowing them to impersonate a higher-privileged role and access fields that their actual role cannot see. The attack requires low privileges (user account with share feature enabled) and network access, with no user interaction required. An attacker can gain unauthorized read access to sensitive data fields by sharing an item as a higher-privileged role. The fix restricts role specification in shares to admin users only, preventing privilege escalation via this vector.
Affected products
- Directus directus < 11.2.0
- Directus @directus/app < 13.3.1
Timeline
- 2025-01-23: disclosed: Advisory published
- 2025-01-23: patched: directus v11.2.0 and @directus/app v13.3.1 released