CVE-2025-64749
Medium · 4.3Directus Vulnerable to Information Leakage in Existing Collections
CVSS
4.3
EPSS
0.3%
Published
Nov 13, 2025
CISA due date
—
The record
An observable difference in error messaging was found in the Directus REST API. The `/items/{collection}` API returns different error messages for these two cases: 1. A user tries to access an existing collection which they are not authorized to access. 2. A user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @directus/api | 0 | 32.0.0 |
| npm | directus | 0 | 11.13.0 |
Related vulnerabilities
- GHSA-cph6-524f-3hgr Directus Vulnerable to Information Leakage in Existing Collections Same vulnerability
- CVE-2026-26185 Directus is a real-time API and App dashboard for managing SQL database content. Also affects @directus/api
- GHSA-jr94-gj3h-c8rf Directus Vulnerable to User Enumeration via Password Reset Timing Attack Also affects @directus/api
- GHSA-3573-4c68-g8cc Directus has open redirect in SAML Also affects @directus/api
- CVE-2026-22032 Directus has open redirect in SAML Also affects @directus/api
- GHSA-8jpw-gpr4-8cmh Directus's conceal fields are searchable if read permissions enabled Also affects @directus/api
- CVE-2025-64748 Directus's conceal fields are searchable if read permissions enabled Also affects @directus/api
- CVE-2026-39942 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus