UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64749

Information Leakage: Existing Collections

Severity
Medium 4.3
Published
13 Nov 2025
Last changed
19 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.13.0
Also known as
GHSA-cph6-524f-3hgr
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns different error messages for two cases: when a user tries to access an existing collection which they are not authorized to access, and when user…

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • Every version before 11.13.0
DirectusServers and applications · github:directus/directus
  • Every version before 11.13.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64749
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64749
  • GitHub Advisory Database https://github.com/advisories/GHSA-cph6-524f-3hgr
  • github.com https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr