CVE-2025-64748: Directus Token Enumeration and Sensitive Field Exposure Vulnerability
Summary
CVE-2025-64748: Directus's conceal fields are searchable if read permissions enabled. Affects directus versions < 11.13.0. Fixed in 11.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that provides a user-friendly interface for managing database content. It allows developers to create custom APIs and manage data through a web interface. The platform is designed to be flexible and scalable, making it suitable for various applications. However, a recent vulnerability has been identified that affects the security of sensitive user data within the Directus system.
Vulnerability Detail
A vulnerability in Directus allows authenticated users with read permissions to search concealed fields, such as tokens, TFA secrets, and passwords, in the 'directus_users' collection. Although the actual values are masked, the presence of matching records can be detected, leading to potential enumeration attacks. This issue arises from the default permissions granted to users, which inadvertently expose sensitive data and increase the risk of account compromise through known password hashes.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.13.0
This is the first release that contains the fix.
npm install directus@11.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict read permissions for users to prevent them from accessing sensitive fields. Review and adjust user roles and permissions in the Directus settings to limit access to concealed data.
Conclusion
The vulnerability CVE-2025-64748 in Directus poses a significant risk by allowing authenticated users to search for sensitive fields, potentially leading to data exposure. It is crucial to update to the patched versions of Directus and @directus/api to mitigate this risk. Additionally, adjusting user permissions can provide a temporary solution until the update is applied.
See every vulnerability recorded for directus →
FAQ
CVE-2025-64748 is a vulnerability in Directus that allows authenticated users to search for concealed fields, potentially exposing sensitive user data.
If your application uses Directus with default permissions, it may expose sensitive information such as tokens and password hashes to authenticated users.
As a temporary measure, restrict user permissions to limit access to sensitive fields until you can apply the update.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
