PT-2026-7914 · Directus · Directus

Denizparlak · Publicado 2026-02-12 · Atualizado 2026-02-13 · CVE-2026-26185

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.14.1

Description A timing-based user enumeration issue exists in the password reset functionality. Providing an invalid reset url parameter results in differing response times – approximately 500ms – between existing and non-existing users, allowing for reliable user enumeration. The password reset endpoint attempts to implement timing protection, but URL validation occurs before this protection is applied, enabling the identification of valid user accounts based on response times. This issue compromises user privacy and could facilitate targeted phishing attacks by confirming account existence.

Recommendations Update to version 11.14.1 or later.

Exploit

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

CVE-2026-26185

GHSA-JR94-GJ3H-C8RF

Produtos afetados

Directus

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26185.json · Exploit
• https://github.com/directus/directus · Nota
• https://github.com/directus/directus/pull/26485 · Nota
• https://github.com/directus/directus/commit/e69aa7a5248c6e3e822cb1ac354dee295df90b2a · Correção
• https://github.com/directus/directus/security/advisories/GHSA-jr94-gj3h-c8rf · Aviso do Fabricante
• https://github.com/directus/directus/releases/tag/v11.14.1 · Nota
• https://twitter.com/_cvereports/status/2022078359249842491 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-jr94-gj3h-c8rf · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1r3pptr/resumen_diario_de_vulnerabilidades_13022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1r3ozdd/resumen_diario_de_vulnerabilidades_13022026 · Publicação no Reddit
• https://osv.dev/vulnerability/CVE-2026-26185 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-26185 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1r3ppbt/resumen_diario_de_vulnerabilidades_13022026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2022081028509110654 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1r3pq3j/resumen_diario_de_vulnerabilidades_13022026 · Publicação no Reddit