CVE-2025-27089: Directus Update Access Vulnerability Due to Overlapping Policies
Summary
CVE-2025-27089: Directus allows updates to non-allowed fields due to overlapping policies. Affects directus versions >= 11.0.0, < 11.1.2. Fixed in 11.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that provides a powerful API for managing content. It allows users to create, manage, and distribute content across various platforms. The system is designed to be flexible and customizable, making it a popular choice for developers. However, it has been identified that certain overlapping policies in the update action can lead to unauthorized access to sensitive fields, potentially compromising user data.
Vulnerability Detail
The vulnerability arises from the way Directus handles overlapping permissions for the update action. When multiple policies allow access to different fields, the system incorrectly permits users to update a superset of fields rather than restricting access to only the fields they are authorized to modify. For instance, a user with permissions to update 'field_a' for item id 1 and 'field_b' for item id 2 can inadvertently update both fields across different items, leading to potential unauthorized changes, including sensitive data like passwords.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.1.2
This is the first release that contains the fix.
npm install directus@11.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, review and adjust the overlapping policies to ensure that they do not grant broader access than intended. This may involve consolidating permissions or explicitly defining access for each field to avoid unintended updates.
Conclusion
The CVE-2025-27089 vulnerability in Directus highlights the importance of careful permission management in applications. By updating to the latest versions and reviewing permission policies, developers can protect their applications from unauthorized access to sensitive data.
See every vulnerability recorded for directus →
FAQ
CVE-2025-27089 is a vulnerability in Directus that allows users to update fields they should not have access to due to overlapping permission policies.
If your application uses Directus and has overlapping update policies, unauthorized users may gain access to sensitive fields, potentially compromising user data.
Directus versions prior to 11.1.2 and @directus/api versions prior to 23.1.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for vulnerabilities in your application. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, review and adjust your permission policies to minimize the risk of unauthorized access until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
