PT-2025-5336 · Directus · Directus

Viters · Published 2025-01-23 · Updated 2025-11-18 · CVE-2025-24353

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.2.0

Description The issue allows a typical user to specify an arbitrary role when sharing an item, enabling them to use a higher-privileged role to view fields they should not be able to see. This affects instances that use the share feature and have a specific roles hierarchy and fields not visible to certain roles.

Recommendations For versions prior to 11.2.0, update to version 11.2.0 or later, which contains a patch to resolve the issue. As a temporary workaround, consider restricting the use of the share feature to admins only, or limit the fields that can be shared to those visible to the sharing user.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-05409

CVE-2025-24353

GHSA-PMF4-V838-29HG

Affected Products

Directus

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24353.json · Exploit
• 🔥 https://youtube.com/watch?v=DbV4IxbWzN4 · Exploit
• https://github.com/directus/directus/commit/e288a43a79613dada905da683f4919c6965ac804 · Patch
• https://github.com/directus/directus/security/advisories/GHSA-pmf4-v838-29hg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pmf4-v838-29hg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24353 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05409 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24353 · Security Note
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/releases/tag/v11.2.0 · Note
• https://github.com/directus/directus/pull/23716 · Note
• https://twitter.com/CVEnew/status/1882501625312653785 · Twitter Post
• https://t.me/cvedetector/16220 · Telegram Post
• https://t.me/cveNotify/143286 · Telegram Post