CVE-2025-24353: Directus Privilege Escalation Vulnerability

CVE-2025-24353 Overview

CVE-2025-24353 affects Directus, a real-time API and application dashboard for managing SQL database content. The vulnerability resides in the share feature of Directus versions prior to 11.2.0. When sharing an item, an authenticated user can specify an arbitrary role rather than being restricted to their assigned role. This allows the user to leverage a higher-privileged role to access fields that should remain hidden from them. The flaw maps to improper privilege management [CWE-269]. Instances affected are those that use the share feature and define role hierarchies with field-level visibility restrictions. Version 11.2.0 contains the fix.

Critical Impact

Authenticated low-privileged users can view restricted field data by abusing the share feature to assume higher-privileged roles.

Affected Products

• Monospace Directus versions prior to 11.2.0
• Node.js deployments of Directus using the share feature
• Instances with role hierarchies and field-level visibility rules

Discovery Timeline

• 2025-01-23 - CVE-2025-24353 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24353

Vulnerability Analysis

The vulnerability is a horizontal and vertical privilege escalation flaw in the Directus share feature. Directus allows users to share individual items through generated share links. The share creation endpoint accepted a role parameter from the client without verifying that the requesting user actually held that role. As a result, a standard user could create a share bound to an administrator or higher-privileged role. Anyone opening the share, including the creator, would then access the item through that elevated role context.

Because Directus enforces field-level permissions per role, assuming a higher-privileged role exposes columns that the originating user is not authorized to see. The impact is limited to confidentiality of field data; integrity and availability are not affected.

Root Cause

The root cause is missing authorization on the role parameter during share creation and missing accountability checks in the /users/me and /permissions/me controllers when the caller is operating under a share scope. The server treated the share request's declared role as authoritative instead of validating it against the authenticated user's actual permissions.

Attack Vector

An attacker needs a valid low-privileged Directus account on a target instance that uses shares and defines role-restricted fields. The attacker issues a share creation request specifying a higher-privileged role identifier, then follows the resulting share link to read fields otherwise invisible to their account. No user interaction from a victim is required.

// Patch excerpt: api/src/controllers/permissions.ts
 router.get(
 	'/me',
 	asyncHandler(async (req, res, next) => {
-		if (!req.accountability?.user && !req.accountability?.role) throw new ForbiddenError();
+		if (!req.accountability?.user && !req.accountability?.role && !req.accountability?.share)
+			throw new ForbiddenError();

 		const result = await fetchAccountabilityCollectionAccess(req.accountability, {
 			schema: req.schema,

Source: GitHub Commit e288a43. The patch adjusts how share-scoped requests resolve their accountability context so permissions reflect the share, not an attacker-supplied role.

// Patch excerpt: api/src/controllers/users.ts
 router.get(
 	'/me',
 	asyncHandler(async (req, res, next) => {
-		if (req.accountability?.share_scope) {
-			const user = {
-				share: req.accountability?.share,
-				role: {
-					id: req.accountability.role,
-					admin_access: false,
-					app_access: false,
+		if (req.accountability?.share) {
+			res.locals['payload'] = {
+				data: {
+					share: req.accountability?.share,
 				},
 			};

-			res.locals['payload'] = { data: user };
 			return next();
 		}

Source: GitHub Commit e288a43.

Detection Methods for CVE-2025-24353

Indicators of Compromise

• Entries in the directus_shares table where the role column references a role the creating user does not belong to.
• API requests to POST /shares or POST /items/directus_shares carrying a role field that resolves to an admin or elevated role.
• Unexpected access to share links by their creators resulting in reads of fields marked non-visible for that user's role.

Detection Strategies

• Audit the directus_shares collection and correlate role values against the creating user's assigned role to flag mismatches.
• Review Directus access logs for /users/me or /permissions/me calls made under a share scope that return elevated role capabilities.
• Compare the Directus server version against the fixed release 11.2.0 across all environments using inventory tooling.

Monitoring Recommendations

• Enable Directus activity logging and forward events to a central log platform for retention and query.
• Alert on share creation activity performed by non-administrative users at abnormal volumes or outside business hours.
• Monitor outbound usage of generated share URLs for repeated access by the share creator shortly after creation.

How to Mitigate CVE-2025-24353

Immediate Actions Required

• Upgrade Directus to version 11.2.0 or later on all affected instances.
• Revoke existing shares created by non-admin users while the vulnerable version was running.
• Review role hierarchies and confirm field-level permissions still match intended visibility after upgrade.

Patch Information

The fix is included in Directus 11.2.0, delivered via pull request #23716 and commit e288a43. See the GitHub Security Advisory GHSA-pmf4-v838-29hg and the v11.2.0 release notes for details.

Workarounds

• Disable the share feature at the permission layer for all non-administrative roles until the upgrade is applied.
• Restrict the directus_shares collection so only trusted roles can create entries.
• Remove field-level visibility differences across roles where feasible to reduce exposure if a share role is manipulated.

# Upgrade Directus via npm to the patched release
npm install directus@11.2.0

# Or pull the patched Docker image
docker pull directus/directus:11.2.0