CVE-2025-64748: Directus concealed fields information disclosure via search

CVE-2025-64748 · Severity: medium · CVSS 6.5 · Published 2025-11-13

Directus is a headless CMS and API platform used to manage backend content and user data. A vulnerability allows authenticated users to search sensitive concealed fields (such as authentication tokens, TFA secrets, and password hashes) when read permissions are enabled. Although the actual values remain masked, attackers can detect successful matches to enumerate and identify accounts with known compromised credentials, increasing the risk of account takeovers and data breaches.

Technologies: Monospace Directus, @directus/api (npm), directus (npm). Vendors: Monospace, npm.

Quick answers

Is CVE-2025-64748 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-64748 being exploited in the wild.
How severe is CVE-2025-64748?
Medium severity, with a CVSS score of 6.5, published 13 November 2025.
Which products and versions are affected?
@directus/api (npm) SEMVER:introduced=0,fixed=32.0.0; directus (npm) SEMVER:introduced=0,fixed=11.13.0.
Is there a fix for CVE-2025-64748?
Yes. @directus/api (npm): upgrade to 32.0.0 or later; directus (npm): upgrade to 11.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64748 attacked?
It is attacked over the network.
Am I affected by CVE-2025-64748?
Check whether you run Monospace Directus, @directus/api (npm) or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @directus/api (npm): upgrade to 32.0.0 or later
    npm install @directus/api@32.0.0
  • directus (npm): upgrade to 11.13.0 or later
    npm install directus@11.13.0

Technical details

This is an information disclosure vulnerability (CWE-201) in Directus's search functionality. Authenticated users with read permissions can perform search queries on concealed fields in the directus_users collection, including sensitive fields like token, tfa_secret, and password. While matching records are returned with masked values (****), the presence of matches confirms the existence of searched values, enabling enumeration attacks. The vulnerability is amplified by Directus's "Recommended Defaults" for App Access, which grant users full read permissions to their role/user records by default. Attackers can leverage publicly available password hash databases to identify accounts with compromised credentials. The fix is available in version 11.13.0 and @directus/api version 32.0.0.

Affected products

  • Directus directus < 11.13.0
  • Directus @directus/api < 32.0.0

Identifiers

  • CVE-2025-64748
  • GHSA-8jpw-gpr4-8cmh

Timeline

  • 2025-11-13: disclosed: GHSA-8jpw-gpr4-8cmh and CVE-2025-64748 published
  • 2025-11-13: patched: Patches released in directus 11.13.0 and @directus/api 32.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.