Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ga3s-595f-2keq
Vulnerability ID VCID-ga3s-595f-2keq
Aliases CVE-2026-35442
GHSA-38hg-ww64-rrwc
Summary Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users. This vulnerability is fixed in 11.17.0.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-863 Incorrect Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2026-35442
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2026-35442
epss 0.00026 https://api.first.org/data/v1/epss?cve=CVE-2026-35442
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-38hg-ww64-rrwc
cvssv3.1 8.1 https://github.com/directus/directus
generic_textual HIGH https://github.com/directus/directus
cvssv3.1 8.1 https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc
cvssv3.1_qr HIGH https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc
generic_textual HIGH https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc
ssvc Track https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2026-35442
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-35442
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-35442
https://github.com/directus/directus
https://nvd.nist.gov/vuln/detail/CVE-2026-35442
GHSA-38hg-ww64-rrwc https://github.com/advisories/GHSA-38hg-ww64-rrwc
GHSA-38hg-ww64-rrwc https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-07T13:30:05Z/ Found at https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35442
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.04829
EPSS Score 0.00018
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:44:54.990788+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/35xxx/CVE-2026-35442.json 38.6.0