CVE-2025-53886: Directus Information Disclosure Vulnerability

CVE-2025-53886 Overview

CVE-2025-53886 is an information disclosure vulnerability in Directus, a real-time API and application dashboard for managing SQL database content. The flaw affects Directus Flows configured with the WebHook trigger. When an authenticated user triggers such a Flow, the application logs the entire incoming request, including security-sensitive cookies that carry access and refresh tokens. Administrators with log access can read these tokens and reuse them to hijack active sessions until the tokens expire. The issue was introduced in version 9.0.0 and remediated in version 11.9.0. The weakness is tracked as CWE-200: Exposure of Sensitive Information.

Critical Impact
A malicious or compromised Directus administrator can hijack any authenticated user session whose WebHook Flow request was captured in application logs, within the token expiration window.

Affected Products

Monospace Directus versions 9.0.0 through 11.8.x (Node.js distribution)
Directus deployments using Flows with the WebHook trigger
Self-hosted and cloud instances relying on logged request data for debugging or auditing

Discovery Timeline

2025-07-15 - CVE-2025-53886 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53886

Vulnerability Analysis

Directus Flows allow administrators to automate operations through configurable triggers, including WebHook triggers that respond to inbound HTTP requests. When a WebHook-triggered Flow executes, Directus writes the full incoming request to its application logs. The logged payload includes request headers and cookies without redaction. Because Directus stores session access tokens and refresh tokens in cookies, these credentials end up in plaintext inside operational logs.

An administrator who can read application logs, or anyone who has gained access to log storage, can extract these tokens and replay them against the Directus API. The attacker inherits the privileges of whichever user initiated the WebHook request. Session impersonation remains possible until the stolen access token expires or the refresh token is revoked.

Root Cause

The root cause is missing sanitization of sensitive request data before it reaches the logging subsystem. Directus did not apply its existing redactObject utility to cookie headers on the WebHook Flow path. The remediation introduces explicit permission and policy checks and restricts how manual and WebHook flows are triggered. The relevant upstream change is pull request #25354.

Attack Vector

Exploitation requires high privileges, specifically log read access, which typically belongs to administrators. The attacker reads Directus logs, locates a WebHook Flow event, and copies the access_token or refresh_token cookie values. The attacker then issues API requests using the stolen cookie, operating as the victim account until the token lifetime ends.

typescript

// Patch excerpt from api/src/flows.ts (#25354)
 import getDatabase from './database/index.js';
 import emitter from './emitter.js';
 import { useLogger } from './logger/index.js';
+import { fetchPermissions } from './permissions/lib/fetch-permissions.js';
+import { fetchPolicies } from './permissions/lib/fetch-policies.js';
 import { ActivityService } from './services/activity.js';
 import { FlowsService } from './services/flows.js';
 import * as services from './services/index.js';
 import { RevisionsService } from './services/revisions.js';
 import type { EventHandler } from './types/index.js';
 import { constructFlowTree } from './utils/construct-flow-tree.js';
 import { getSchema } from './utils/get-schema.js';
+import { getService } from './utils/get-service.js';
 import { JobQueue } from './utils/job-queue.js';
 import { redactObject } from './utils/redact-object.js';
 import { scheduleSynchronizedJob, validateCron } from './utils/schedule.js';

Source: GitHub commit 22be460. The patch wires manual and WebHook Flow execution through permission and policy fetchers so that triggering, and the data captured during triggering, respects authorization boundaries.

Detection Methods for CVE-2025-53886

Indicators of Compromise

Log entries from WebHook Flow executions containing Cookie: headers with directus_session_token, access_token, or refresh_token values
API requests originating from unexpected IP addresses while reusing a cookie value previously observed in Flow logs
Repeated session refresh calls (/auth/refresh) using refresh tokens shortly after a WebHook Flow was invoked

Detection Strategies

Grep historical Directus logs for cookie headers to inventory tokens that may have leaked and should be invalidated
Correlate WebHook Flow activity with subsequent authenticated API calls from new user agents or geographies
Alert on administrator accounts reading log files or querying log aggregation systems outside of normal maintenance windows

Monitoring Recommendations

Forward Directus application logs to a centralized store with strict role-based access and audit trails
Monitor /auth/refresh and privileged API endpoints for session reuse anomalies tied to recent Flow executions
Review administrator role membership and log reader permissions on a recurring basis

How to Mitigate CVE-2025-53886

Immediate Actions Required

Upgrade Directus to version 11.9.0 or later as published in Directus Release v11.9.0
Rotate all user sessions by invalidating existing access and refresh tokens after upgrading
Purge or restrict access to historical log files that may contain leaked tokens from WebHook Flow executions
Review administrator accounts and remove unnecessary log read privileges

Patch Information

The fix is delivered in Directus 11.9.0 through pull request #25354 and commit 22be460. Additional context is available in GitHub Security Advisory GHSA-f24x-rm6g-3w5v.

Workarounds

Disable Flows configured with WebHook triggers until the upgrade is applied
Reduce access token lifetime via ACCESS_TOKEN_TTL to minimize the hijacking window
Route Directus logs to a destination with stricter access controls than the application administrator role

bash

# Shorten access token TTL and tighten log handling in Directus .env
ACCESS_TOKEN_TTL=5m
REFRESH_TOKEN_TTL=1h
LOG_LEVEL=warn
# Then upgrade
npm install directus@11.9.0