CVE-2025-30352: Directus Search Parameter Vulnerability Allows Unauthorized Field Enumeration
Summary
CVE-2025-30352: Directus search query parameter allows enumeration of non permitted fields. Affects directus versions >= 9.0.0-alpha.4, < 11.5.0. Fixed in 11.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that enables users to manage and deliver content across various platforms. It provides a flexible API and a user-friendly interface for managing collections of data. However, a vulnerability exists in the way it handles search queries, potentially exposing sensitive information to unauthorized users.
Vulnerability Detail
The vulnerability arises from the search query parameter in Directus, which allows users to filter items based on fields they do not have permission to view. This oversight permits the enumeration of sensitive field contents, such as email addresses and password hashes, leading to significant security risks. The issue occurs because the searchable columns are not adequately checked against user permissions when constructing the where clauses for the search query.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.5.0
This is the first release that contains the fix.
npm install directus@11.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict public access to sensitive fields in your Directus collections. Ensure that only authorized users have permission to view critical data, thereby minimizing the risk of exposure until the package is updated.
Conclusion
The Directus vulnerability identified as CVE-2025-30352 poses a significant risk by allowing unauthorized access to sensitive fields through the search functionality. It is crucial for users to update to the patched version and implement proper access controls to safeguard their data.
See every vulnerability recorded for directus →
FAQ
The vulnerability allows unauthorized users to access and enumerate fields they do not have permission to view through the search query parameter.
The vulnerability can lead to the exposure of sensitive information, including email addresses and password hashes, which could compromise user accounts and system security.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring any signup.
Yes, the vulnerability has been patched in Directus version 11.5.0. It is recommended to update to this version to mitigate the risk.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
