PT-2026-31649 · Directus · Directus

Br41Nslug · Published 2026-04-04 · Updated 2026-04-09 · CVE-2026-39943

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.17.0

Description Directus stores revision records in directus revisions when items are created or updated. The revision snapshot code did not consistently use the prepareDelta sanitization pipeline, allowing sensitive fields like user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys to be stored in plaintext within revision records. This could allow a user or service account with read access to directus revisions to retrieve sensitive information, potentially leading to account takeover or unauthorized use of third-party API keys.

Recommendations Update to version 11.17.0 or later.

Fix

Cleartext Storage of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-312

CWE-200

Related Identifiers

CVE-2026-39943

GHSA-MVV8-V4JJ-G47J

Affected Products

Directus

References · 6

• https://github.com/directus/directus/security/advisories/GHSA-mvv8-v4jj-g47j · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mvv8-v4jj-g47j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39943 · Security Note
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/releases/tag/v11.17.0 · Note
• https://twitter.com/CVEnew/status/2042302799002943895 · Twitter Post