Executive brief
Directus is a headless CMS platform with workflow automation (Flows). When using the WebHook trigger, security-sensitive tokens and cookies in incoming requests are logged in plaintext. Malicious administrators with access to these logs can steal session credentials and hijack user accounts until the tokens expire.
Technical details
This is a sensitive information exposure vulnerability (CWE-200, CWE-532) in Directus's Flow logging mechanism. When a WebHook trigger is invoked, all incoming request details—including HTTP headers and cookies containing access and refresh tokens—are logged without redaction or sanitization. The vulnerability requires high privilege (admin account) to access the logs and user interaction (triggering the Flow), but allows an attacker to harvest valid session tokens and hijack user sessions within the token lifetime. The issue was fixed in version 11.9.0, with the commit 859f664f56fb50401c407b095889cea38ff580e5 implementing token redaction in logs.
Affected products
- Directus Directus >=9.0.0, before 11.9.0
Timeline
- 2025-07-15: disclosed
- 2025-07-15: patched: Fixed in version 11.9.0