Skip to content
OpenAdvisories

Product · directus

@directus/api

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-26185

    Directus Affected by User Enumeration via Password Reset Timing Attack

    Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time diffe…

    directus directus @directus/api directus npm