Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-nug7-m3d7-f7gq
Vulnerability ID VCID-nug7-m3d7-f7gq
Aliases CVE-2025-53889
GHSA-7cvf-pxgp-42fc
Summary Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload to the Flow. Depending on what the Flow is set up to do this can lead to the Flow executing potential tasks on the attacker's behalf without authenticating.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-285 Improper Authorization
CWE-287 Improper Authentication
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2025-53889
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2025-53889
epss 0.00244 https://api.first.org/data/v1/epss?cve=CVE-2025-53889
cvssv3.1 6.5 https://github.com/directus/directus
generic_textual MODERATE https://github.com/directus/directus
cvssv3.1 6.5 https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb
generic_textual MODERATE https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb
ssvc Track https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb
cvssv3.1 6.5 https://github.com/directus/directus/releases/tag/v11.9.0
generic_textual MODERATE https://github.com/directus/directus/releases/tag/v11.9.0
ssvc Track https://github.com/directus/directus/releases/tag/v11.9.0
cvssv3.1 6.5 https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc
generic_textual MODERATE https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc
ssvc Track https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2025-53889
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-53889
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-53889
https://github.com/directus/directus
https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb
https://github.com/directus/directus/releases/tag/v11.9.0
CVE-2025-53889 https://nvd.nist.gov/vuln/detail/CVE-2025-53889
GHSA-7cvf-pxgp-42fc https://github.com/advisories/GHSA-7cvf-pxgp-42fc
GHSA-7cvf-pxgp-42fc https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:43:29Z/ Found at https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/directus/directus/releases/tag/v11.9.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:43:29Z/ Found at https://github.com/directus/directus/releases/tag/v11.9.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-07-15T13:43:29Z/ Found at https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-53889
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.4796
EPSS Score 0.00244
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:24:23.361228+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/CVE-2025-53889.yml 38.6.0