Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-b5vw-9vy2-xbev
Vulnerability ID VCID-b5vw-9vy2-xbev
Aliases CVE-2025-30351
GHSA-56p6-qw3c-fq2g
Summary Suspended Directus user can continue to use session token to access API Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status.
Status Published
Exploitability 0.5
Weighted Severity 3.1
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-672 Operation on a Resource after Expiration or Release
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2025-30351
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2025-30351
cvssv3.1 3.5 https://github.com/directus/directus
generic_textual LOW https://github.com/directus/directus
cvssv3.1 3.5 https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771
generic_textual LOW https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771
ssvc Track https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771
cvssv3.1 3.5 https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g
generic_textual LOW https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g
ssvc Track https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g
cvssv3.1 3.5 https://nvd.nist.gov/vuln/detail/CVE-2025-30351
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-30351
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-30351
https://github.com/directus/directus
https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771
CVE-2025-30351 https://nvd.nist.gov/vuln/detail/CVE-2025-30351
GHSA-56p6-qw3c-fq2g https://github.com/advisories/GHSA-56p6-qw3c-fq2g
GHSA-56p6-qw3c-fq2g https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-26T17:26:16Z/ Found at https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-26T17:26:16Z/ Found at https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-30351
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.60865
EPSS Score 0.00397
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:23:39.928493+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/CVE-2025-30351.yml 38.6.0