Vulnerability details
CVE-2026-35442
directus directus
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
CVSS 3.1
8.1High
Official description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users. This vulnerability is fixed in 11.17.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| directus | directus | < 11.17.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-07
- Last updated
- 2026-04-07
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.34%
Probability of exploitation in 30 days
28%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor
- CWE-863Incorrect Authorization