Description
Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Version 11.13.0 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| directus | directus | < 11.13.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @directus/api | < 32.0.0 | 32.0.0 | GHSA-8jpw-gpr4-8cmh |
| npm | directus | < 11.13.0 | 11.13.0 | GHSA-8jpw-gpr4-8cmh |