CVE-2025-30351: Directus Session Token Vulnerability Allows Suspended Users to Access API
Summary
CVE-2025-30351: Suspended Directus user can continue to use session token to access API. Affects directus versions >= 10.10.0, < 11.5.0. Fixed in 11.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that allows users to manage their database content through a user-friendly API. It provides features such as user authentication, role-based access control, and real-time updates. However, a vulnerability exists in the session management system that allows suspended users to continue accessing the API using their session tokens.
Vulnerability Detail
The vulnerability arises from a missing check in the 'verifySessionJWT' function, which fails to verify whether a user is still active before allowing access to the API. This oversight means that a user can log in while active, obtain a session token, and continue to use that token even after being suspended. The implications of this vulnerability are significant, as it undermines the security measures intended to restrict access for suspended users, potentially exposing sensitive data and functionality to unauthorized users.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.5.0
This is the first release that contains the fix.
npm install directus@11.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually invalidate session tokens for suspended users by implementing a custom middleware that checks user status before allowing access to the API. This can be done by adding a check in your API routes to verify if the user is active before processing requests.
Conclusion
In summary, CVE-2025-30351 is a significant vulnerability in Directus that allows suspended users to access the API using their session tokens. It is crucial to update to the patched version 11.15.0 or later to mitigate this risk. Additionally, implementing a temporary workaround can help secure your application until an update can be performed.
See every vulnerability recorded for directus →
FAQ
CVE-2025-30351 is a vulnerability in Directus that allows suspended users to continue accessing the API using their session tokens.
If your application uses Directus and has suspended users, this vulnerability could allow those users to access sensitive data and functionality, posing a security risk.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your package-lock.json file on the Vulert playground, you can determine if your application is affected by this vulnerability.
If an immediate update is not possible, implement a custom middleware to check user status before processing API requests as a temporary workaround.
The CVSS score of this vulnerability is 3.5, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
