Information Disclosure Vulnerability in Directus API by Directus
CVE-2025-64749

4.3MEDIUM

Key Information:

Vendor

Directus

Status
Directus
Vendor
CVE Published:
13 November 2025

What is CVE-2025-64749?

A vulnerability was identified in the Directus REST API, where versions prior to 11.13.0 exhibit differing error messages when unauthorized users access collections. This exposes sensitive information about collection existence, potentially allowing unauthorized access to data. Upgrading to version 11.13.0 is recommended to secure applications against this exposure.

Affected Version(s)

directus < 11.13.0

References

https://github.com/directus/directus/security/advisories/...
x_refsource_CONFIRM
https://github.com/directus/directus/commit/f99c9b89071f9...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64749 : Information Disclosure Vulnerability in Directus API by Directus