PT-2025-46915 · Directus · Directus

Published 2025-11-13 · Updated 2025-12-08 · CVE-2025-64749

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0

Description Directus REST API exhibits differing error messages when accessing existing but unauthorized collections versus non-existent collections via the /items/{collection} API endpoint. This discrepancy leaks information about the existence of collections to unauthorized users. The collection variable in the API endpoint is a key component of this issue. Specifically, when a user attempts to access a collection they lack permission for, the error message indicates the collection exists, while a request for a non-existent collection yields a different error message.

Recommendations Versions prior to 11.13.0 should be updated to version 11.13.0 or later.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Side Channel Attack

Weakness Enumeration

CWE-209

CWE-203

Related Identifiers

CVE-2025-64749

GHSA-CPH6-524F-3HGR

Affected Products

Directus

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64749.json · Exploit
• https://github.com/directus/directus/commit/f99c9b89071f9d136cc9b0d0c182f2d24542bc31 · Patch
• https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cph6-524f-3hgr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64749 · Security Note
• https://github.com/directus/directus · Note
• https://t.me/cveNotify/145132 · Telegram Post
• https://t.me/CVEtracker/37299 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ox660i/resumen_diario_de_vulnerabilidades_14112025 · Reddit Post
• https://t.me/cveNotify/142749 · Telegram Post