Executive brief
Directus is a headless CMS platform that manages content and user data. When administrators configure automated workflows (Flows) to handle user creation or updates, they can inadvertently log sensitive user information such as passwords or personal data to console logs. A malicious admin with workflow configuration privileges can deliberately exploit this to expose other users' sensitive data, potentially leading to account takeover or privacy violations.
Technical details
This vulnerability is a sensitive information disclosure (CWE-532) in Directus event hooks used for user CRUD operations. The root cause is that user data passed to Flows' "Log to Console" operation is not redacted before being written to logs, allowing sensitive fields (passwords, emails, personal information) to be exposed in plaintext. The attack requires high privilege (admin role) and user interaction (configuring the workflow), but once configured, logs any user data created or modified. Affected versions are 9.0.0 through 11.8.x; the fix is available in Directus 11.9.0 and later, which implements sensitive field redaction in logging contexts.
Affected products
- Directus Directus 9.0.0 through 11.8.x; fixed in 11.9.0
Timeline
- 2025-07-15: disclosed
- 2025-07-15: patched: Fix available in Directus 11.9.0