Improper access control in Directus - CVE-2025-64748
Published: April 23, 2026
Vulnerability identifier: #VU127119
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-64748
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Directus
Affected software:
Directus
Directus
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in concealed fields of the directus_users collection when processing search operations. A remote user can search concealed sensitive fields to disclose sensitive information.
Matching records are returned with masked values, allowing confirmation that searched values such as tokens, TFA secrets, and password hashes exist.
How to mitigate CVE-2025-64748
Install security update from vendor's website.