UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53889

Missing permission checks for manual trigger Flows

Severity
Medium 6.5
Published
14 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.9.0
Also known as
GHSA-7cvf-pxgp-42fc
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload to the Flow. Depending on what the Flow is set up to do this can lead to the Flow executing potential tasks on the…

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • From 9.12.0 before 11.9.0
DirectusServers and applications · github:directus/directus
  • From 9.12.0 before 11.9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53889
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53889
  • GitHub Advisory Database https://github.com/advisories/GHSA-7cvf-pxgp-42fc
  • github.com https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc