PT-2025-12982 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 10.10.0 through 11.4.x Description: The issue allows a suspended user to access the API using a token generated in session auth mode, despite their suspended status. This occurs due to a missing check in the verifySessionJWT...