Quick answers
- Is CVE-2025-64746 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-64746 being exploited in the wild.
- How severe is CVE-2025-64746?
- Medium severity, with a CVSS score of 4.6, published 13 November 2025.
- Which products and versions are affected?
- directus (npm) SEMVER:introduced=0,fixed=11.13.0.
- Is there a fix for CVE-2025-64746?
- Yes. directus (npm): upgrade to 11.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-64746 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-64746?
- Check whether you run Monospace Directus or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- directus (npm): upgrade to 11.13.0 or later
npm install directus@11.13.0
Technical details
The vulnerability is an authorization bypass caused by improper cleanup of field-level permissions in the Directus permissions table when fields are deleted. When a field is removed from a collection, its reference in the permissions table persists as stale data. If a new field is subsequently created with the same name, it automatically re-applies the old permission entry, bypassing the expected permission reset. An authenticated attacker with the ability to create fields in a collection can exploit this by creating a field that matches a previously deleted one, inheriting unintended read or write permissions. The vulnerability requires user interaction (field creation) and low-level privileges. A fix is available in version 11.13.0.
Affected products
- Directus Directus < 11.13.0
Identifiers
- CVE-2025-64746
- GHSA-9x5g-62gj-wqf2
Timeline
- 2025-11-13: disclosed: Advisory published
- 2025-11-13: patched: Fix available in version 11.13.0