MEDIUM4.3npm
GHSA-3573-4c68-g8cc· CVE-2026-22032Directus has open redirect in SAML
Modified: 2/3/2026
package
npm/@directus/api
pkg:npm/%40directus/api
LOW3.5npm
GHSA-56p6-qw3c-fq2g· CVE-2025-30351Suspended Directus user can continue to use session token to access API
Modified: 9/10/2026
MEDIUM5.0npm
GHSA-68g8-c275-xf2m· CVE-2024-46990Directus vulnerable to SSRF Loopback IP filter bypass
Modified: 9/18/2024
HIGH7.5npm
GHSA-849r-qrwj-8rv4· CVE-2024-54151Directus allows unauthenticated access to WebSocket events and operations
Modified: 9/10/2026
MEDIUM6.5npm
GHSA-8jpw-gpr4-8cmh· CVE-2025-64748Directus's conceal fields are searchable if read permissions enabled
Modified: 11/15/2025
MEDIUM5.0npm
GHSA-8p72-rcq4-h6pw· CVE-2024-39699Directus Blind SSRF On File Import
Modified: 9/10/2026
MEDIUM5.4npm
GHSA-99vm-5v2h-h6r6· CVE-2025-27089Directus allows updates to non-allowed fields due to overlapping policies
Modified: 2/19/2025
HIGH7.4npm
GHSA-cff8-x7jv-4fm8· CVE-2024-45596Session is cached for OpenID and OAuth2 if `redirect` is not used
Modified: 11/17/2025
MEDIUM4.3npm
GHSA-cph6-524f-3hgr· CVE-2025-64749Directus Vulnerable to Information Leakage in Existing Collections
Modified: 11/15/2025
MEDIUM5.3npm
GHSA-jr94-gj3h-c8rf· CVE-2026-26185Directus Vulnerable to User Enumeration via Password Reset Timing Attack
Modified: 2/13/2026
CRITICAL9.3npm
GHSA-mv33-9f6j-pfmc· CVE-2025-55746Directus allows unauthenticated file upload and file modification due to lacking input sanitization
Modified: 8/20/2025
MEDIUM4.2npm
GHSA-vw58-ph65-6rxp· CVE-2024-47822Directus inserts access token from query string into logs
Modified: 4/14/2025