CVE-2026-35442 - Vulnerability Analysis

Overview

Directus < 11.17.0 contains an information disclosure vulnerability caused by incorrect handling of aggregate functions on concealed fields, letting authenticated users with read access extract sensitive concealed data, exploit requires user authentication.

Severity & Score

Impact

Authenticated users can extract sensitive concealed data including API tokens and 2FA secrets, risking account compromise and data leakage.

Mitigation

Update to version 11.17.0 or later.

References

• https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner