CVE-2026-35442: Directus Vulnerability Allows Authenticated Users to Extract Concealed Fields via Aggregate Queries
Summary
CVE-2026-35442: Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries. Affects directus versions < 11.17.0. Fixed in 11.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that provides a user-friendly interface for managing database content. It allows developers to create custom APIs and manage data through a web interface. The platform is designed for flexibility and scalability, making it a popular choice for developers. However, a recent vulnerability has been identified that affects how Directus handles concealed fields in aggregate queries, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from the mishandling of fields marked with the 'conceal' special type during aggregate queries. When aggregate functions such as 'min' and 'max' are applied, the system incorrectly returns raw database values instead of the intended masked placeholders. This flaw allows any authenticated user with read access to the affected collection to extract sensitive information, including static API tokens and two-factor authentication secrets from the 'directus_users' table. The implications of this vulnerability are severe, as it can lead to account takeovers and bypassing of two-factor authentication, compromising user security.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.17.0
This is the first release that contains the fix.
npm install directus@11.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to aggregate queries for authenticated users until the package can be updated. This can be done by adjusting permissions in the Directus settings to limit access to sensitive collections.
Conclusion
The vulnerability identified as CVE-2026-35442 in Directus poses significant risks by allowing authenticated users to extract concealed fields through aggregate queries. It is crucial for users to update to the patched version to safeguard against potential account takeovers and unauthorized access to sensitive information.
See every vulnerability recorded for directus →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Any authenticated user with read access to affected collections in Directus can exploit this vulnerability.
Attackers can potentially extract static API tokens and two-factor authentication secrets from the 'directus_users' table.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider restricting access to aggregate queries for authenticated users as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
