TI-2025-18096 Aliases CVE-2025-24353 GHSA-pmf4-v838-29hg

Directus privilege escalation vulnerability using Share feature

MEDIUM 56CWE-269Published 2025-01-23 · Updated 2025-02-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00396 34th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed directus (directus): 11.2.0directus (npm): 11.2.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
directus	directus	before 11.2.0	11.2.0	Patch available	CNA
—	directus (npm)	before 11.2.0	11.2.0	Patch available	GHSA-pmf4-v838-29hg
—	@directus/app (npm)	before 13.3.1	13.3.1	Patch available	GHSA-pmf4-v838-29hg

directus Vendordirectus Affected before 11.2.0 Fixed in 11.2.0 Patch available CNA
directus (npm) Vendor— Affected before 11.2.0 Fixed in 11.2.0 Patch available GHSA-pmf4-v838-29hg
@directus/app (npm) Vendor— Affected before 13.3.1 Fixed in 13.3.1 Patch available GHSA-pmf4-v838-29hg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:monospace:directus::::::node.js::*	before 11.2.0	Vulnerable	directus

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:* Versions before 11.2.0 Vulnerable ·directus

Remediation

Fix · CNA directus (directus) Fixed in 11.2.0
Fix · GHSA-pmf4-v838-29hg directus (npm) Fixed in 11.2.0 Advisory →
Fix · GHSA-pmf4-v838-29hg @directus/app (npm) Fixed in 13.3.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-24353
2026-10-03 Alias added: GHSA-pmf4-v838-29hg

References

Exploit 2

Patch 1

https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-24353

Other 3

TI-2025-21659 Directus's webhook trigger flows can leak sensitive data CVSS 3.1HIGH 8.6
TI-2024-36266 Directus allows unauthenticated access to WebSocket events and operations CVSS 3.1HIGH 7.5
TI-2024-26791 Directus allows SSO User Enumeration CVSS 3.1HIGH 7.5
TI-2024-23956 Directus is soft-locked by providing a string value to random string util CVSS 3.1HIGH 7.5
TI-2024-26624 Directus Incorrectly handles _in` filter CVSS 3.1HIGH 7.7
TI-2025-21658 Directus `search` query parameter allows enumeration of non permitted fields CVSS 3.1MEDIUM 5.3

See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences