TI-2025-21657 Aliases CVE-2025-30351 GHSA-56p6-qw3c-fq2g

Suspended Directus user can continue to use session token to access API

MEDIUM 53CWE-672Published 2025-03-26 · Updated 2025-06-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in `verifySessionJWT` to verify that a user is actually still active and allowed to access the API. One can extract the session token obtained by, e.g. login in to the app while still active and then, after the user has been suspended continue to use that token until it expires. Version 11.5.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00374 31st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed directus (directus): 11.5.0directus (npm): 11.5.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
directus	directus	10.10.0 to before 11.5.0	11.5.0	Patch available	CNA
—	directus (npm)	10.10.0 to before 11.5.0	11.5.0	Patch available	GHSA-56p6-qw3c-fq2g
—	@directus/api (npm)	18.0.0 to before 24.0.1	24.0.1	Patch available	GHSA-56p6-qw3c-fq2g
—	@directus/types (npm)	11.0.7 to before 13.0.0	13.0.0	Patch available	GHSA-56p6-qw3c-fq2g

directus Vendordirectus Affected 10.10.0 to before 11.5.0 Fixed in 11.5.0 Patch available CNA
directus (npm) Vendor— Affected 10.10.0 to before 11.5.0 Fixed in 11.5.0 Patch available GHSA-56p6-qw3c-fq2g
@directus/api (npm) Vendor— Affected 18.0.0 to before 24.0.1 Fixed in 24.0.1 Patch available GHSA-56p6-qw3c-fq2g
@directus/types (npm) Vendor— Affected 11.0.7 to before 13.0.0 Fixed in 13.0.0 Patch available GHSA-56p6-qw3c-fq2g

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:monospace:directus::::::node.js::*	10.10.0 to before 11.5.0	Vulnerable	directus

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:* Versions 10.10.0 to before 11.5.0 Vulnerable ·directus

Remediation

Fix · CNA directus (directus) Fixed in 11.5.0
Fix · GHSA-56p6-qw3c-fq2g directus (npm) Fixed in 11.5.0 Advisory →
Fix · GHSA-56p6-qw3c-fq2g @directus/api (npm) Fixed in 24.0.1 Advisory →
Fix · GHSA-56p6-qw3c-fq2g @directus/types (npm) Fixed in 13.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-30351
2026-10-03 Alias added: GHSA-56p6-qw3c-fq2g

References

TI-2025-21659 Directus's webhook trigger flows can leak sensitive data CVSS 3.1HIGH 8.6
TI-2024-36266 Directus allows unauthenticated access to WebSocket events and operations CVSS 3.1HIGH 7.5
TI-2024-26791 Directus allows SSO User Enumeration CVSS 3.1HIGH 7.5
TI-2024-23956 Directus is soft-locked by providing a string value to random string util CVSS 3.1HIGH 7.5
TI-2024-26624 Directus Incorrectly handles _in` filter CVSS 3.1HIGH 7.7
TI-2025-21658 Directus `search` query parameter allows enumeration of non permitted fields CVSS 3.1MEDIUM 5.3

See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences