@directus/api (>=20.0.0-rc.0, <=23.1.0), directus (>=11.0.0-rc.1, <=11.1.2) potentially affected by CVE-2025-24353 via @directus/app (>=13.0.0, <=13.3.0)

@directus/app NPM version =13.0.0, =20.0.0-rc.0, =11.0.0-rc.1, =11.1.2 Source cves: CVE-2025-24353 Source advisory: OSV:GHSA-PMF4-V838-29HG...

@directus/api (>=20.0.0-rc.0, <=23.1.0) potentially affected by CVE-2025-24353 via directus (>=11.0.0, <=11.1.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =23.1.0 Source cves: CVE-2025-24353 Source advisory: OSV:GHSA-PMF4-V838-29HG...

CVE-2025-24353

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instanc...

CVE-2025-24353

Directus prior to version 11.2.0 is vulnerable to privilege escalation via the share feature. A user can specify an arbitrary role when sharing an item, enabling access to fields that should be restricted for their role. Affected instances are those using the share feature with a role hierarchy a...

CVE-2025-24353 Directus privilege escalation vulnerability using Share feature

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instanc...