PT-2026-30332 · Directus · Directus

Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35442

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Directus (affected versions not specified)

Description Aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus users. This occurs because the masking logic does not account for the nested structure of aggregate query results, causing it to skip concealed fields and return their raw values. An authenticated attacker can harvest static API tokens for all users, including administrators, enabling authentication as any account without credentials. TOTP seeds stored in directus users can also be extracted, allowing an attacker to bypass two-factor authentication for any account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Incorrect Authorization

Weakness Enumeration

CWE-200

CWE-863

Related Identifiers

CVE-2026-35442

GHSA-38HG-WW64-RRWC

Affected Products

Directus

References · 7

• https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38hg-ww64-rrwc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35442 · Security Note
• https://github.com/directus/directus · Note
• https://twitter.com/CVEnew/status/2041282869071602070 · Twitter Post
• https://twitter.com/pulsepatchio/status/2040803845048062055 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sdyq51/resumen_diario_de_vulnerabilidades_06042026 · Reddit Post