Is CVE-2025-64749 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64749 being exploited in the wild.

How severe is CVE-2025-64749?

Medium severity, with a CVSS score of 4.3, published 13 November 2025.

Which products and versions are affected?

@directus/api (npm) SEMVER:introduced=0,fixed=32.0.0; directus (npm) SEMVER:introduced=0,fixed=11.13.0.

Is there a fix for CVE-2025-64749?

Yes. @directus/api (npm): upgrade to 32.0.0 or later; directus (npm): upgrade to 11.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64749 attacked?

It is attacked over the network.

Am I affected by CVE-2025-64749?

Check whether you run Monospace Directus, @directus/api (npm) or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64749: Directus information leakage in REST API error messages

CVE-2025-64749 · Severity: medium · CVSS 4.3 · Published 2025-11-13

Directus is a headless CMS and API management platform. The REST API's error messages reveal whether restricted collections exist, allowing unauthorized users to enumerate collections they cannot access. An authenticated attacker can use different error responses to determine which restricted data collections are present in the system.

Technologies: Monospace Directus, @directus/api (npm), directus (npm). Vendors: Monospace, npm.

Quick answers

Is CVE-2025-64749 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64749 being exploited in the wild.
How severe is CVE-2025-64749?: Medium severity, with a CVSS score of 4.3, published 13 November 2025.
Which products and versions are affected?: @directus/api (npm) SEMVER:introduced=0,fixed=32.0.0; directus (npm) SEMVER:introduced=0,fixed=11.13.0.
Is there a fix for CVE-2025-64749?: Yes. @directus/api (npm): upgrade to 32.0.0 or later; directus (npm): upgrade to 11.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64749 attacked?: It is attacked over the network.
Am I affected by CVE-2025-64749?: Check whether you run Monospace Directus, @directus/api (npm) or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@directus/api (npm): upgrade to 32.0.0 or later
```
npm install @directus/api@32.0.0
```
directus (npm): upgrade to 11.13.0 or later
```
npm install directus@11.13.0
```

Technical details

The vulnerability is an information leakage issue (CWE-203, CWE-209) in the Directus REST API /items/{collection} endpoint. The API returns distinct error messages for unauthorized access to an existing collection versus requests for a non-existent collection, creating an observable discrepancy. An authenticated user with low privileges can exploit this by comparing error messages to determine whether a collection exists, even if they lack permission to access it. The attack requires network access and low-privilege authentication but no user interaction. Patches are available in directus version 11.13.0 and @directus/api version 32.0.0.

Affected products

Directus Directus before 11.13.0
Directus @directus/api before 32.0.0

Identifiers

CVE-2025-64749
GHSA-cph6-524f-3hgr

Timeline

2025-11-13: disclosed
2025-11-13: patched: directus 11.13.0 and @directus/api 32.0.0

References

https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.