PT-2026-30330 · Directus · Directus

Bugbunny-Research + 1 · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35413

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus (affected versions not specified)

Description When GRAPHQL INTROSPECTION=false is configured, Directus blocks standard GraphQL introspection queries but the /graphql/system endpoint's server specs graphql resolver returns an equivalent SDL representation of the schema. This bypasses introspection controls, exposing schema structure (collection names, field names, types, and relationships) to unauthenticated users at the public permission level, and to authenticated users at their permitted permission level. Administrators setting GRAPHQL INTROSPECTION=false had a false sense of security, as schema information remained accessible via the SDL endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-35413

GHSA-WXWM-3FXV-MRVX

Affected Products

Directus

References · 6

• https://github.com/directus/directus/security/advisories/GHSA-wxwm-3fxv-mrvx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35413 · Security Note
• https://osv.dev/vulnerability/GHSA-wxwm-3fxv-mrvx · Vendor Advisory
• https://github.com/directus/directus · Note
• https://twitter.com/dailycve/status/2040707824733298775 · Twitter Post
• https://twitter.com/CVEnew/status/2041282870883532894 · Twitter Post