CVE-2026-26185 — Observable Discrepancy in Directus

CWE-203 — Observable Discrepancy4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 97.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
DirectusDirectus APIMonospace Directus+1 more
Timeline
PublishedFeb 12

Description

Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶npmdirectus/api< 32.2.0
▶CVEListV5directus/directus< 11.14.1
▶npmdirectus/directus< 11.14.1
▶NVDmonospace/directus< 11.15.0
▶CVEListV5directus/directus_api< 32.2.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
Directus Vulnerable to User Enumeration via Password Reset Timing Attack↗2026-02-12
▶
OSV
Directus Vulnerable to User Enumeration via Password Reset Timing Attack↗2026-02-12
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-26185 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶