CVE-2025-64746
📋 TL;DR
A permission inheritance vulnerability in Directus allows stale field-level permissions to persist after field deletion. When a deleted field's name is reused for a new field, the new field inherits outdated permissions, potentially granting unauthorized data access. This affects all Directus installations prior to version 11.13.0.
💻 Affected Systems
- Directus
📦 What is this software?
Directus by Monospace
⚠️ Risk & Real-World Impact
Worst Case
Administrators unintentionally grant excessive read/write permissions to roles, leading to data exposure or unauthorized modifications in sensitive collections.
Likely Case
Field name reuse in development or multi-tenant environments causes permission misconfigurations, allowing unintended data access.
If Mitigated
With strict field naming policies and permission audits, the risk is limited to configuration errors.
🎯 Exploit Status
Exploitation requires authenticated administrative access to delete/create fields and relies on field name reuse.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.13.0
Vendor Advisory: https://github.com/directus/directus/security/advisories/GHSA-9x5g-62gj-wqf2
Restart Required: Yes
Instructions:
1. Backup your Directus database and files. 2. Update Directus to version 11.13.0 or later via package manager or manual installation. 3. Restart the Directus service. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Manual Permission Cleanup
allManually remove stale permission entries from the database after field deletions.
DELETE FROM directus_permissions WHERE field = 'deleted_field_name';
Field Naming Policy
allImplement strict field naming conventions to avoid reusing deleted field names.
🧯 If You Can't Patch
- Audit all field-level permissions and manually clean up entries for deleted fields.
- Implement monitoring for permission table changes and field creation/deletion events.
🔍 How to Verify
Check if Vulnerable:
Check your Directus version. If it's below 11.13.0, you are vulnerable.Check Version:
npx directus versionVerify Fix Applied:
After updating to 11.13.0+, test by creating/deleting a field with permissions and verifying permissions are properly cleaned up.📡 Detection & Monitoring
Log Indicators:
- Unusual permission changes in audit logs
- Field deletion events without corresponding permission cleanup
Network Indicators:
- Unexpected API responses showing data that should be restricted
SIEM Query:
event_source="directus" AND (event_type="field_deleted" OR event_type="permission_modified")