Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-53886

Medium
4.5/10

Summary

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions, when using Directus Flows with the WebHook trigger, all incoming request details are logged, including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the flow. This issue affects Directus versions 9.12.0 through 9.24.0 and @directus/api versions 9.25.0 through 27.1.0. This has the same fix as CVE-2025-53885.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • HIGH
  • HIGH
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published