Search for packages
| purl | pkg:npm/%40directus/api@23.2.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5u8r-s8tz-guhm
Aliases: CVE-2025-55746 GHSA-mv33-9f6j-pfmc |
Affected by 4 other vulnerabilities. |
|
|
VCID-7fzh-j76t-5kd3
Aliases: CVE-2025-30351 GHSA-56p6-qw3c-fq2g |
Affected by 5 other vulnerabilities. |
|
|
VCID-anfb-6kfn-a7h7
Aliases: CVE-2026-26185 GHSA-jr94-gj3h-c8rf |
Directus Vulnerable to User Enumeration via Password Reset Timing Attack A timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. |
Affected by 0 other vulnerabilities. |
|
VCID-hed8-anm5-ukc9
Aliases: CVE-2026-22032 GHSA-3573-4c68-g8cc |
Directus has open redirect in SAML An open redirect vulnerability exists in the Directus SAML authentication callback endpoint. The `RelayState` parameter is used in redirects without proper validation against an allowlist of permitted domains. |
Affected by 1 other vulnerability. |
|
VCID-na3v-me78-aqcg
Aliases: CVE-2025-64749 GHSA-cph6-524f-3hgr |
Directus Vulnerable to Information Leakage in Existing Collections An observable difference in error messaging was found in the Directus REST API. The `/items/{collection}` API returns different error messages for these two cases: 1. A user tries to access an existing collection which they are not authorized to access. 2. A user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections. |
Affected by 2 other vulnerabilities. |
|
VCID-nvha-b5tb-dqdt
Aliases: CVE-2025-64748 GHSA-8jpw-gpr4-8cmh |
Directus's conceal fields are searchable if read permissions enabled A vulnerability allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-bjzg-mzjf-cfau |
CVE-2024-54151
GHSA-849r-qrwj-8rv4 |