CVE-2024-47822: @directus/api Access Token Exposure in Logs
Summary
CVE-2024-47822: Directus inserts access token from query string into logs. Affects @directus/api versions < 21.0.0. Fixed in 21.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that allows users to manage content and data through a user-friendly interface. The @directus/api package provides the backend API functionalities necessary for Directus to operate. This package is widely used for building applications that require a flexible content management system. However, it has a vulnerability that exposes sensitive access tokens in system logs, which can lead to unauthorized access and data manipulation.
Vulnerability Detail
The vulnerability arises from the fact that access tokens included in the query string are not redacted when the logging style is set to 'raw'. This means that if an attacker gains access to the logs, they could potentially retrieve these tokens, which may grant them administrative control over the Directus instance. The issue is particularly concerning for systems that do not sanitize or protect their logs adequately, as it could lead to unauthorized data access and manipulation.
How To Fix
Latest published version: 40.0.0 as of 22 Oct 2026
npm install @directus/api@40.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.0.0
This is the first release that contains the fix.
npm install @directus/api@21.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can change the logging style to something other than 'raw' to prevent access tokens from being logged. This can be done by setting the LOG_STYLE environment variable to 'json' or another supported format. For example: export LOG_STYLE='json'.
Conclusion
In summary, CVE-2024-47822 is a vulnerability in the @directus/api package that exposes access tokens in logs when the logging style is set to 'raw'. It is crucial to update to version 21.0.0 or later to mitigate this risk. Additionally, using Vulert can help monitor your application for such vulnerabilities in real-time.
See every vulnerability recorded for @directus/api →
FAQ
The vulnerability has a CVSS score of 4.2, which is classified as moderate severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update the package immediately, consider changing the logging style to prevent sensitive information from being logged.
If exploited, this vulnerability could allow attackers to gain unauthorized access to your Directus instance, leading to data breaches and manipulation.
Yes, if long-lived static tokens are included in the query string, they could remain in the logs indefinitely, increasing the risk of unauthorized access.
References
Related vulnerabilities
Recent vulnerabilities recorded for @directus/api.
