CVE-2026-26185: Directus User Enumeration via Password Reset Timing Attack
Summary
CVE-2026-26185: Directus Vulnerable to User Enumeration via Password Reset Timing Attack. Affects directus versions < 11.14.1. Fixed in 11.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that enables users to manage and deliver content through a flexible API. It is designed for developers and content creators, offering features like real-time collaboration, role-based access control, and customizable data structures. However, a vulnerability exists in its password reset functionality, which can be exploited for user enumeration.
Vulnerability Detail
A timing-based user enumeration vulnerability exists in the password reset functionality of Directus. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users. This timing discrepancy allows attackers to reliably determine the existence of user accounts, violating user privacy and potentially facilitating targeted phishing attacks.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.14.1
This is the first release that contains the fix.
npm install directus@11.14.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned to mitigate this vulnerability other than updating to the patched versions.
Conclusion
The Directus vulnerability CVE-2026-26185 poses a significant risk by allowing user enumeration through timing attacks in the password reset functionality. It is crucial to update to the latest patched versions to mitigate this risk and protect user privacy.
See every vulnerability recorded for directus →
FAQ
The vulnerability allows attackers to enumerate user accounts based on response timing differences in the password reset functionality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to user privacy violations and may enable targeted phishing attacks by confirming the existence of user accounts.
Yes, patches are available. Update Directus to version 11.14.1 and @directus/api to version 32.2.0 or later.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
