CVE-2025-64749

{
  "id": "CVE-2025-64749",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-13T22:15:52.390",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns different error messages for two cases: when a user tries to access an existing collection which they are not authorized to access, and when user tries to access a non-existing collection. The two differing error messages leak the existence of collections to users which are not authorized to access these collections. Version 11.13.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Directus es una API en tiempo real y un panel de control de aplicaciones para gestionar contenido de base de datos SQL. Se encontró una diferencia observable en los mensajes de error en la API REST de Directus en versiones de Directus anteriores a la versión 11.13.0. La API '/items/{collection}' devuelve mensajes de error diferentes para dos casos: cuando un usuario intenta acceder a una colección existente a la que no está autorizado a acceder, y cuando un usuario intenta acceder a una colección no existente. Los dos mensajes de error diferentes filtran la existencia de colecciones a usuarios que no están autorizados a acceder a estas colecciones. La versión 11.13.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "directus",
          "product": "directus",
          "versions": [
            {
              "version": "< 11.13.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-14T17:14:48.614823Z",
          "id": "CVE-2025-64749",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-203"
        },
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "11.13.0",
              "matchCriteriaId": "19DDC40E-F676-4824-A433-37CFBEDFEBDB"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/directus/directus/commit/f99c9b89071f9d136cc9b0d0c182f2d24542bc31",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/directus/directus/security/advisories/GHSA-cph6-524f-3hgr",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}