CVE-2025-64749

🗓️ 13 Nov 2025 21:34:54Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 51 Views🌐 WEB

Directus REST API leaks collection existence via two errors for unauthorized and non existent collections; fixed in 11.13.0.

Reporter	Title	Published	Views	Family All 19
Circl	CVE-2025-64749	14 Nov 202501:03	–	circl
CNNVD	Directus security vulnerabilities	13 Nov 202500:00	–	cnnvd
Cvelist	CVE-2025-64749 Directus Vulnerable to Information Leakage in Existing Collections	13 Nov 202521:34	–	cvelist
EUVD	EUVD-2025-177199	13 Nov 202523:07	–	euvd
Github Security Blog	Directus Vulnerable to Information Leakage in Existing Collections	13 Nov 202523:07	–	github
Mend	CVE-2025-64749	13 Nov 202521:34	–	mend
NVD	CVE-2025-64749	13 Nov 202522:15	–	nvd
osv_cve	CVE-2025-64749 Directus Vulnerable to Information Leakage in Existing Collections	13 Nov 202521:34	–	osv_cve
osv_ghsa	GHSA-CPH6-524F-3HGR Directus Vulnerable to Information Leakage in Existing Collections	13 Nov 202523:07	–	osv_ghsa
Positive Technologies	PT-2025-46915	13 Nov 202500:00	–	ptsecurity

NVD

Vulners

Node

monospace directusRange<11.13.0node.js

[
  {
    "vendor": "directus",
    "product": "directus",
    "versions": [
      {
        "version": "< 11.13.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/directus/directus/commit/f99c9b89071f9d136cc9b0d0c182f2d24542bc31
github	www.github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr

Parameter	Position	Path	Description	CWE
{collection}	path	/items/{collection}	The /items/{collection} API returns different error messages depending on whether a collection exists and the user is authorized to access it, leading to information disclosure about the existence of collections.	CWE-203, CWE-209

19 Oct 2026 13:10Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.14.3

EPSS0.00349

SSVC