Executive brief
Directus, a popular headless CMS and backend API platform, stores revision history of all item changes in a database table. Due to incomplete sanitization of sensitive data during revision recording, credentials such as authentication tokens, two-factor secrets, API keys, and stored passwords could be saved in plain text within revision records. Any user with access to the revision history table could retrieve these secrets, potentially leading to account takeover or unauthorized API access.
Technical details
The vulnerability is a cleartext storage of sensitive information flaw (CWE-312, CWE-200) in Directus's revision snapshot mechanism. When items are created or updated, revision records are written to the directus_revisions table without consistently passing the data through the prepareDelta sanitization pipeline. This allows sensitive fields (token, tfa_secret, external_identifier, auth_data, credentials, and AI API keys) to be stored unencrypted. The vulnerability is present in two code paths: (1) item create/update revisions skip prepareDelta sanitization, and (2) authentication service revisions during auto-suspension record the raw user object. The attack requires network access and low-privilege database read access to directus_revisions or flow logs. A fix is available in version 11.17.0 and later.
Affected products
- Directus Directus <11.17.0
Timeline
- 2026-04-04: disclosed
- 2026-04-04: patched: version 11.17.0 released