Search for vulnerabilities
| Vulnerability ID | VCID-na3v-me78-aqcg |
| Aliases |
CVE-2025-64749
GHSA-cph6-524f-3hgr |
| Summary | Directus Vulnerable to Information Leakage in Existing Collections An observable difference in error messaging was found in the Directus REST API. The `/items/{collection}` API returns different error messages for these two cases: 1. A user tries to access an existing collection which they are not authorized to access. 2. A user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections. |
| Status | Published |
| Exploitability | None |
| Weighted Severity | None |
| Risk | None |
| Affected and Fixed Packages | Package Details |
| System | Score | Found at |
|---|---|---|
| epss | 0.00046 | https://api.first.org/data/v1/epss?cve=CVE-2025-64749 |
| cvssv3.1_qr | MODERATE | https://github.com/advisories/GHSA-cph6-524f-3hgr |
| cvssv3.1_qr | MODERATE | https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr |
| Reference id | Reference type | URL |
|---|---|---|
| https://api.first.org/data/v1/epss?cve=CVE-2025-64749 | ||
| https://github.com/directus/directus | ||
| https://github.com/directus/directus/commit/f99c9b89071f9d136cc9b0d0c182f2d24542bc31 | ||
| CVE-2025-64749 | https://nvd.nist.gov/vuln/detail/CVE-2025-64749 | |
| GHSA-cph6-524f-3hgr | https://github.com/advisories/GHSA-cph6-524f-3hgr | |
| GHSA-cph6-524f-3hgr | https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr |
| Percentile | 0.14466 |
| EPSS Score | 0.00046 |
| Published At | May 30, 2026, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-05-30T21:04:45.992842+00:00 | GitLab Importer | Import | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/CVE-2025-64749.yml | 38.6.0 |