CVE-2025-24353CWE-269

Directus privilege escalation vulnerability using Share feature

Medium · published January 23, 2025

CVSS v3.1
5.0
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles. Version 11.2.0 contains a patch the issue.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.5th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-01-23T17:45Z
EPSS history
Timeline
  • 23 JAN 17:45Z
    Directus privilege escalation vulnerability using Share feature
    cvelistv5