Field-Level Permission Leak in Directus API Management Tool

CVE-2025-64746

What is CVE-2025-64746?

Directus, an advanced API and application dashboard for SQL database content management, has a significant issue concerning field-level permissions. Prior to version 11.13.0, when a field is deleted from a collection, its associated permissions entry remains unchanged in the permissions table. This oversight can lead to a dangerous security situation; if another field is subsequently created with the same name, it will automatically inherit the outdated permissions linked to the deleted field. This unintended consequence creates an opportunity for unauthorized access, especially in environments where administrators frequently repurpose field names, under the false assumption that all permissions would have been reset. Version 11.13.0 effectively addresses this vulnerability, ensuring that permissions are correctly managed and mitigated.

References