Executive brief
Directus is a headless CMS and API platform used to manage backend content and user data. A vulnerability allows authenticated users to search sensitive concealed fields (such as authentication tokens, TFA secrets, and password hashes) when read permissions are enabled. Although the actual values remain masked, attackers can detect successful matches to enumerate and identify accounts with known compromised credentials, increasing the risk of account takeovers and data breaches.
Technical details
This is an information disclosure vulnerability (CWE-201) in Directus's search functionality. Authenticated users with read permissions can perform search queries on concealed fields in the directus_users collection, including sensitive fields like token, tfa_secret, and password. While matching records are returned with masked values (****), the presence of matches confirms the existence of searched values, enabling enumeration attacks. The vulnerability is amplified by Directus's "Recommended Defaults" for App Access, which grant users full read permissions to their role/user records by default. Attackers can leverage publicly available password hash databases to identify accounts with compromised credentials. The fix is available in version 11.13.0 and @directus/api version 32.0.0.
Affected products
- Directus directus < 11.13.0
- Directus @directus/api < 32.0.0
Timeline
- 2025-11-13: disclosed: GHSA-8jpw-gpr4-8cmh and CVE-2025-64748 published
- 2025-11-13: patched: Patches released in directus 11.13.0 and @directus/api 32.0.0