CVE-2025-64746: Directus Improper Permission Handling on Deleted Fields
Summary
CVE-2025-64746: Directus has Improper Permission Handling on Deleted Fields. Affects directus versions < 11.13.0. Fixed in 11.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that allows users to manage their content and data through a user-friendly interface. It is designed to be flexible and scalable, making it suitable for various applications. However, it has a vulnerability related to improper handling of permissions for fields that have been deleted, which can lead to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from Directus's failure to properly clean up field-level permissions when a field is deleted. When a field is removed, its permissions remain in the permissions table. If a new field with the same name is created later, it inherits the old permissions, potentially granting unauthorized access to roles that should not have access to that data. This issue poses a significant risk, especially in multi-tenant or production environments where field names may be reused, leading to unintended data exposure.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.13.0
This is the first release that contains the fix.
npm install directus@11.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid reusing field names that have been previously deleted until the package has been updated. Additionally, regularly review and audit permissions to ensure that no unauthorized access is granted.
Conclusion
The improper permission handling vulnerability in Directus (CVE-2025-64746) poses a significant risk of unauthorized access to sensitive data. It is crucial to update to version 11.13.0 or later to mitigate this risk. Regular audits and careful management of field names can help maintain security until the update is applied.
See every vulnerability recorded for directus →
FAQ
CVE-2025-64746 is a vulnerability in Directus that allows improper permission handling on deleted fields, potentially leading to unauthorized access.
If your application uses Directus and reuses field names, it may unintentionally grant access to sensitive data, posing a security risk.
If an immediate update is not possible, avoid reusing field names that have been deleted and conduct regular audits of your permissions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 4.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
