Search for packages
| purl | pkg:npm/%40directus/api@9.26.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-anfb-6kfn-a7h7
Aliases: CVE-2026-26185 GHSA-jr94-gj3h-c8rf |
Directus Vulnerable to User Enumeration via Password Reset Timing Attack A timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. |
Affected by 0 other vulnerabilities. |
|
VCID-f5p9-649h-hkhs
Aliases: CVE-2024-47822 GHSA-vw58-ph65-6rxp |
Affected by 7 other vulnerabilities. |
|
|
VCID-hed8-anm5-ukc9
Aliases: CVE-2026-22032 GHSA-3573-4c68-g8cc |
Directus has open redirect in SAML An open redirect vulnerability exists in the Directus SAML authentication callback endpoint. The `RelayState` parameter is used in redirects without proper validation against an allowlist of permitted domains. |
Affected by 1 other vulnerability. |
|
VCID-msb5-197k-a3er
Aliases: CVE-2024-46990 GHSA-68g8-c275-xf2m |
Affected by 7 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
|
VCID-na3v-me78-aqcg
Aliases: CVE-2025-64749 GHSA-cph6-524f-3hgr |
Directus Vulnerable to Information Leakage in Existing Collections An observable difference in error messaging was found in the Directus REST API. The `/items/{collection}` API returns different error messages for these two cases: 1. A user tries to access an existing collection which they are not authorized to access. 2. A user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections. |
Affected by 2 other vulnerabilities. |
|
VCID-nvha-b5tb-dqdt
Aliases: CVE-2025-64748 GHSA-8jpw-gpr4-8cmh |
Directus's conceal fields are searchable if read permissions enabled A vulnerability allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. |
Affected by 2 other vulnerabilities. |
|
VCID-x8uk-jaz5-efd9
Aliases: CVE-2024-39699 GHSA-8p72-rcq4-h6pw |
Affected by 8 other vulnerabilities. |
|
|
VCID-xt9c-32g5-mqes
Aliases: CVE-2024-45596 GHSA-cff8-x7jv-4fm8 |
Affected by 6 other vulnerabilities. Affected by 8 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||