CVE-2025-64746
Medium · 4.6Directus has Improper Permission Handling on Deleted Fields
CVSS
4.6
EPSS
0.2%
Published
Nov 14, 2025
CISA due date
—
The record
Directus does not properly clean up field-level permissions when a field is deleted. If a new field with the same name is created later, the system automatically re-applies the old permissions, which can lead to unauthorized access.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | directus | 0 | 11.13.0 |
Related vulnerabilities
- GHSA-9x5g-62gj-wqf2 Directus has Improper Permission Handling on Deleted Fields Same vulnerability
- CVE-2026-39942 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-39943 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35410 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35411 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35412 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35441 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35413 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus