CVE-2026-39943
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Apr 9, 2026
CISA due date
—
The record
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | directus | 0 | 11.17.0 |
Related vulnerabilities
- GHSA-mvv8-v4jj-g47j Directus: Sensitive fields exposed in revision history Same vulnerability
- CVE-2026-39942 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35410 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35411 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35412 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35441 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35413 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus
- CVE-2026-35442 Directus is a real-time API and App dashboard for managing SQL database content. Also affects directus