UpHeron
All vulnerabilities

Servers and applications

CVE-2025-24353

Privilege escalation using Share feature

Severity
Medium 4.3
Published
23 Jan 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.2.0
Also known as
GHSA-pmf4-v838-29hg
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted are those that use the share feature and have specific roles hierarchy and…

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • Every version before 11.2.0
DirectusServers and applications · github:directus/directus
  • Every version before 11.2.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-24353
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-24353
  • GitHub Advisory Database https://github.com/advisories/GHSA-pmf4-v838-29hg
  • github.com https://github.com/directus/directus/security/advisories/GHSA-pmf4-v838-29hg