CVE-2025-64748
published 2025-11-13CVE-2025-64748: Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.24%
15.2th percentile
Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Version 11.13.0 fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| directus | api | >= 0 < 32.0.0 | 32.0.0 |
| directus | directus | < 11.13.0 | 11.13.0 |
| directus | directus | >= 0 < 11.13.0 | 11.13.0 |
| monospace | directus | < 11.13.0 | 11.13.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Directus's conceal fields are searchable if read permissions enabled
ghsa·2025-11-13
CVE-2025-64748 [MEDIUM] CWE-201 Directus's conceal fields are searchable if read permissions enabled
Directus's conceal fields are searchable if read permissions enabled
## Summary
A vulnerability allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data.
## Details
The system permits search operations on concealed fields in the `directus_users` collection, including `token`, `tfa_secret`, `password`. Matching records are returned with masked values, but their presence confirms the searched value exists.
The "Recommended Defaults" for "App Access" grant users full read permissions to their role/user records, inadvertently enabling them to search for any user's tokens, TFA secrets, and password ha
OSV
Directus's conceal fields are searchable if read permissions enabled
osv·2025-11-13
CVE-2025-64748 [MEDIUM] Directus's conceal fields are searchable if read permissions enabled
Directus's conceal fields are searchable if read permissions enabled
## Summary
A vulnerability allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data.
## Details
The system permits search operations on concealed fields in the `directus_users` collection, including `token`, `tfa_secret`, `password`. Matching records are returned with masked values, but their presence confirms the searched value exists.
The "Recommended Defaults" for "App Access" grant users full read permissions to their role/user records, inadvertently enabling them to search for any user's tokens, TFA secrets, and password ha
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-13
Published