Executive brief
Directus is a headless CMS and backend-as-a-service platform used to manage APIs, databases, and content. When an administrator suspends a user account, the system fails to invalidate that user's existing session tokens. A suspended employee or attacker with a captured session token can continue accessing the API and its data until the token expires, circumventing the intended suspension control.
Technical details
The vulnerability exists in the verifySessionJWT function, which validates session tokens without checking whether the associated user account is still active or suspended. The vulnerability class is CWE-672 (Operation on a Resource after Expiration or Release). An attacker who has obtained a valid session token (e.g., via login before suspension or through token theft) can send API requests with "Authorization: Bearer <token>" and gain access despite the user account being suspended. The attack requires that the token-bearing user had an active account at the time of token generation and is now suspended; the token remains valid until its natural expiration. The fix, released in versions 11.5.0 (directus), 24.0.1 (@directus/api), and 13.0.0 (@directus/types), adds a check to verify user status in the session verification logic and clears sessions when a user's status changes.
Affected products
- Directus directus >=10.10.0, <11.5.0
- Directus @directus/api >=18.0.0, <24.0.1
- Directus @directus/types >=11.0.7, <13.0.0
Timeline
- 2025-03-26: disclosed: Published on GitHub Security Advisory
- 2025-02-27: patched: Patch commit ef179931c55b50c110feca8404901d5633940771 merged