VulnerabilityAnalyzed

CVE-2026-35442

This vulnerability is fixed in 11.17.0.

HIGH 8.1EPSS 0.34%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users. This vulnerability is fixed in 11.17.0.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-200, CWE-863
Affected: monospace/directus
Source: security-advisories@github.com

References

https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwcVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.