Unrestricted GraphQL Introspection in Directus API Management Software

CVE-2026-35413

What is CVE-2026-35413?

Directus, a real-time API and app dashboard for SQL database content management, had a vulnerability allowing unauthorized access to sensitive GraphQL schema information. Although prior configurations successfully blocked standard introspection queries when GRAPHQL_INTROSPECTION was set to false, the resolver at the /graphql/system endpoint exposed an equivalent SDL representation of the schema. This oversight permitted the leakage of collection names, field types, and relationships to both unauthenticated users at the public permission level and authenticated users based on their access rights. This issue was remediated in version 11.16.1.

References