Executive brief
Directus is a popular headless CMS platform that allows users to access and manage collections of data through query parameters. A flaw in the search functionality allows authenticated users to discover sensitive field values they shouldn't have permission to view—such as email addresses, password hashes, and administrative tokens—by filtering search results on restricted fields. This could lead to unauthorized exposure of confidential user and system information.
Technical details
The vulnerability is an information disclosure flaw (CWE-200) in Directus's search query parameter handling. When processing the search parameter to filter collection items, the application does not enforce field-level permissions on searchable string and numeric columns before injecting them into the WHERE clause. An attacker with collection read access can craft search queries referencing restricted fields, enumerate their contents, and extract sensitive data such as email addresses, password hashes, and API tokens. The vulnerability affects versions 9.0.0-alpha.4 through 11.4.x and is fixed in version 11.5.0 (commit ac5a9964d9926f20dc063a74cb417dc7bbad676d). Attack vector is network-based with no privilege or user interaction requirement.
Affected products
- Directus Directus 9.0.0-alpha.4 to 11.4.x
Timeline
- 2025-03-26: disclosed
- 2025-03-26: patched: Fixed in Directus 11.5.0