CVE-2025-30351

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in...

@citrineos/server (>=1.1.1, <=1.8.1), @directus-forge/extensions (>=0.0.1, <=0.0.6) +37 more potentially affected by CVE-2025-30351 via @directus/types (>=11.0.7, <=12.2.2)

@directus/types NPM version =11.0.7, =1.1.1, =0.0.1, =1.0.0, =18.0.0, =1.0.0, =1.0.0, =11.0.0, =1.2.2, =0.0.3, =0.0.1, =0.0.15 and more Source cves: CVE-2025-30351 Source advisory: OSV:GHSA-56P6-QW3C-FQ2G...

@directus/api (>=18.0.0, <=24.0.1), @linotype/directus-extension-linotype (>=1.2.2, <=1.3.5) +2 more potentially affected by CVE-2025-30351 via directus (>=10.10.0, <=11.4.1)

directus NPM version =10.10.0, =18.0.0, =1.2.2, =1.0.0, =2.0.0 - directus-extension-blog-year-filter 1.0.0 Source cves: CVE-2025-30351 Source advisory: OSV:GHSA-56P6-QW3C-FQ2G...

@directus/api (21.0.1), @linotype/directus-extension-linotype (>=1.2.2, <=1.3.5) +3 more potentially affected by CVE-2025-30351 via @directus/api (>=18.0.0, <=24.0.0)

@directus/api NPM version =18.0.0, =1.2.2, =10.10.0, =1.0.0, =2.0.0 - directus-extension-blog-year-filter 1.0.0 Source cves: CVE-2025-30351 Source advisory: OSV:GHSA-56P6-QW3C-FQ2G...

CVE-2025-30351 Suspended Directus user can continue to use session token to access API

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in...

CVE-2025-30351 Suspended Directus user can continue to use session token to access API

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in...

CVE-2025-30351

CVE-2025-30351 affects Directus: real-time API and app dashboard for SQL DB content. From version 10.10.0 up to, but not including, 11.5.0, a suspended user can keep using a token from session auth to access the API because verifySessionJWT does not check that the user is still active. This enabl...