UpHeron
All vulnerabilities

Servers and applications

CVE-2025-27089

Overlapping policies allow update to non-allowed fields

Severity
Medium 4.3
Published
19 Feb 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.1.2
Also known as
GHSA-99vm-5v2h-h6r6
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the `update` action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is allowed to update the superset of fields allowed by any of the policies. E.g. have one policy allowing…

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • From 11.0.0 before 11.1.2
DirectusServers and applications · github:directus/directus
  • From 11.0.0 before 11.1.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-27089
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-27089
  • GitHub Advisory Database https://github.com/advisories/GHSA-99vm-5v2h-h6r6
  • github.com https://github.com/directus/directus/security/advisories/GHSA-99vm-5v2h-h6r6