SB2026090293 - Multiple vulnerabilities in Directus

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the share update path when handling share update requests. A remote user can update a share they own to reassign the user_created and role fields to administrator values to disclose sensitive information.

Exploitation requires update permission on directus_shares, an item the account is allowed to share, and knowledge of an administrator user and role identifier.

2) Use of Incorrectly-Resolved Name or Reference (CVE-ID: N/A)

CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to activate an account with a stored email address they do not control.

The vulnerability exists due to use of incorrectly-resolved name or reference in the public registration and email verification flow when processing registration requests under accent-insensitive email comparison. A remote attacker can submit an accented variant of an existing email address to activate an account with a stored email address they do not control.

Public registration and email verification must be enabled, and the database must be MySQL or MariaDB using an accent-insensitive collation.

Remediation

Install update from vendor's website.

References

• https://github.com/directus/directus/security/advisories/GHSA-7h45-q5jx-7r87
• https://github.com/directus/directus/security/advisories/GHSA-8xp8-xrh2-88vr