CVE-2025-27089

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is...

CVE-2025-27089

creationtimestamp| type| source ---|---|--- 2025-02-19 18:06:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3likej7ksw226 2025-02-19 20:24:59+00:00| seen| https://t.me/cvedetector/18457...

@directus/api (>=20.0.0-rc.0, <=23.0.0) potentially affected by CVE-2025-27089 via directus (>=11.0.0, <=11.1.1)

directus NPM version =11.0.0, =20.0.0-rc.0, =23.0.0 Source cves: CVE-2025-27089 Source advisory: OSV:GHSA-99VM-5V2H-H6R6...

directus (>=11.0.0, <=11.1.1) potentially affected by CVE-2025-27089 via @directus/api (>=22.0.0, <=23.0.0)

@directus/api NPM version =22.0.0, =11.0.0, =11.1.1 Source cves: CVE-2025-27089 Source advisory: OSV:GHSA-99VM-5V2H-H6R6...

CVE-2025-27089

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is...

CVE-2025-27089 Overlapping policies allow update to non-allowed fields in directus

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is...

CVE-2025-27089 Overlapping policies allow update to non-allowed fields in directus

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is...

CVE-2025-27089

Directus has a vulnerability (CVE-2025-27089) where overlapping update policies can cause a user to update fields not permitted for a specific item. Root cause: the system previously validated access at the item level; the fix evaluates permissions per field in the validateItemAccess query and re...