CVE-2025-27089: Monospace Directus Auth Bypass Vulnerability

CVE-2025-27089 Overview

CVE-2025-27089 affects Directus, a real-time API and application dashboard for managing SQL database content. The vulnerability arises when two overlapping policies for the update action grant access to different fields on the same collection. Directus incorrectly merges permissions and allows a user to update the superset of fields permitted by any matching policy, rather than validating field-level access per item. Affected deployments risk unauthorized modification of sensitive fields, including the password field on user accounts. The issue is tracked under CWE-863: Incorrect Authorization and has been resolved in Directus v11.1.2.

Critical Impact
Authenticated users can update fields they should not have write access to, including credential fields such as user account passwords.

Affected Products

Monospace Directus (Node.js) versions prior to 11.1.2
Directus deployments using overlapping update policies on the same collection
Self-hosted and cloud installations sharing the affected permissions engine

Discovery Timeline

2025-02-19 - CVE-2025-27089 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-27089

Vulnerability Analysis

Directus enforces field-level access through policies attached to roles. Before v11, a single permission applied to any given item, so the fields listed by that permission defined the write surface. When multiple overlapping policies apply to the same collection under different filter conditions, the permissions engine failed to reconcile field-level rules against the specific item being updated. Instead, it computed the union of fields across all matching policies and permitted updates to any of them.

Consider a policy granting update access to field_a where id == 1, and a second policy granting update access to field_b where id == 2. A user assigned both policies can update field_a and field_b on items with id values 1 and 2, even though neither policy independently authorizes that combination. This becomes exploitable when one policy exposes a sensitive field, such as password on the directus_users collection.

Root Cause

The root cause is an authorization gap in the validateItemAccess database query. The original implementation verified access to the item as a whole and then relied on the merged field list from policy evaluation. It never re-validated that the user held permission for each requested field on each targeted item. This is a classic incorrect authorization defect where the enforcement point evaluates coarser context than the decision requires.

Attack Vector

Exploitation requires an authenticated account with two or more overlapping update policies on the same collection. The attacker issues a standard PATCH request through the Directus REST or GraphQL API and includes fields granted by any of their policies. The server accepts the write against items outside the intended scope of each individual policy. No user interaction is required beyond the attacker's own API call. See the GitHub Security Advisory GHSA-99vm-5v2h-h6r6 for the vendor's technical description.

Detection Methods for CVE-2025-27089

Indicators of Compromise

Unexpected PATCH or mutation requests targeting sensitive fields such as password, email, role, or status on the directus_users collection
Audit log entries in directus_activity and directus_revisions showing field updates by accounts that should lack that field-level permission
Password hash changes in user records without a corresponding password reset workflow event

Detection Strategies

Review Directus role and policy assignments to identify accounts holding two or more overlapping update policies on the same collection
Correlate API access logs with the directus_activity table to flag update operations that touch fields outside a single policy's declared scope
Compare pre-upgrade and post-upgrade behavior in a staging environment to identify writes that succeed under the vulnerable engine but fail under 11.1.2

Monitoring Recommendations

Alert on any modification to the password column of directus_users originating from non-administrative accounts
Ingest Directus activity logs into a centralized logging or SIEM platform and build queries for anomalous field-level writes
Monitor for privilege changes on Directus roles and policies, since attackers may attempt to introduce a second overlapping policy to weaponize this flaw

How to Mitigate CVE-2025-27089

Immediate Actions Required

Upgrade all Directus instances to version 11.1.2 or later without delay
Audit user accounts and rotate credentials for any user whose password field may have been altered by an unauthorized account
Enumerate all roles that hold multiple update policies on the same collection and validate that field lists reflect the intended access boundaries

Patch Information

The fix is included in Directus v11.1.2. The patch modifies validateItemAccess to evaluate permissions for each requested field on each targeted item. Instead of returning field values, the query returns a flag indicating whether the caller has access to that specific field on that specific item, using the same case/when mechanism the permissions engine uses to strip non-permitted fields. The final check fails if any requested field lacks access on any target item.

Workarounds

No workarounds are available; the vendor states upgrading to 11.1.2 is the only remediation
As a compensating control until upgrade, consolidate overlapping update policies into a single policy per collection so that only one permission set can match a given item

bash

# Upgrade Directus via npm to the patched release
npm install directus@11.1.2

# Or with Docker, pin the image tag to a fixed version
docker pull directus/directus:11.1.2
docker compose up -d