CVE-2025-53889: Monospace Directus Auth Bypass Vulnerability

CVE-2025-53889 Overview

CVE-2025-53889 is an authentication and authorization flaw [CWE-287] in Directus, a real-time API and application dashboard for managing SQL database content. Versions from 9.12.0 up to but not including 11.9.0 fail to validate whether the user invoking a manual trigger Flow has permission to read directus_flows or the collections and items supplied as payload. Unauthenticated attackers can invoke manual trigger Flows and cause the platform to execute actions on their behalf against items they should not access. Version 11.9.0 resolves the issue by enforcing permission checks on the triggering user.

Critical Impact
Unauthenticated network-based attackers can invoke Directus manual trigger Flows and cause the application to act on collections or items outside the caller's permission scope.

Affected Products

Monospace Directus versions >= 9.12.0 and < 11.9.0
Directus deployments running on Node.js
Directus instances exposing Flows with manual triggers

Discovery Timeline

2025-07-15 - CVE-2025-53889 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53889

Vulnerability Analysis

Directus Flows support several trigger types, including manual triggers invoked through the API. The manual trigger endpoints accept a payload identifying items and collections that the Flow should process. In vulnerable releases, these endpoints skip the permission checks applied elsewhere in the platform, so the caller's access rights against directus_flows and the target collection are never evaluated.

An attacker can call the manual trigger endpoint, pass arbitrary item identifiers, and let the Flow execute privileged operations defined by its configured operations. Depending on how the Flow is composed, this can produce information disclosure or unauthorized modification of records. Because manual trigger Flows are expected to enforce stricter security than webhook Flows, applications built on Directus assume caller identity is validated when it is not.

Root Cause

The root cause is missing authorization enforcement on manual trigger Flow execution paths. The API path handling Flow invocation did not consult the permission subsystem before dispatching the Flow's operations against the supplied payload, so the effective identity used for downstream work was not constrained to the caller's rights.

Attack Vector

Exploitation occurs over the network against an exposed Directus API without authentication or user interaction. An attacker sends a crafted request to a manual trigger Flow endpoint with a payload referencing the target collection and items. The Flow then executes its configured operations, which may include reads, writes, notifications, or invocations of external services under the Directus service context.

typescript

// Security patch in api/src/flows.ts (excerpt)
// Fix manual flows to only trigger with appropriate permissions (#25354)
 import getDatabase from './database/index.js';
 import emitter from './emitter.js';
 import { useLogger } from './logger/index.js';
+import { fetchPermissions } from './permissions/lib/fetch-permissions.js';
+import { fetchPolicies } from './permissions/lib/fetch-policies.js';
 import { ActivityService } from './services/activity.js';
 import { FlowsService } from './services/flows.js';
 import * as services from './services/index.js';
 import { RevisionsService } from './services/revisions.js';
 import type { EventHandler } from './types/index.js';
 import { constructFlowTree } from './utils/construct-flow-tree.js';
 import { getSchema } from './utils/get-schema.js';
+import { getService } from './utils/get-service.js';
 import { JobQueue } from './utils/job-queue.js';
 import { redactObject } from './utils/redact-object.js';
 import { scheduleSynchronizedJob, validateCron } from './utils/schedule.js';

Source: GitHub Commit 22be460. The patch introduces fetchPermissions and fetchPolicies calls into the Flows execution path so that manual triggers evaluate the caller's rights against directus_flows and the target collection before running.

Detection Methods for CVE-2025-53889

Indicators of Compromise

Requests to Directus Flow trigger endpoints under /flows/trigger/{id} from unauthenticated sessions or clients with no prior login activity.
Flow execution log entries in directus_activity or directus_revisions referencing collections or items the invoking user has no defined permissions for.
Spikes in manual trigger Flow invocations from a single IP or user agent against multiple Flow IDs.

Detection Strategies

Correlate API access logs with Directus directus_activity records to identify Flow executions that lack a matching authenticated session or that touch items outside the caller's role permissions.
Enumerate all Flows with trigger: manual and inventory which collections and operations they touch, then alert on invocations that fall outside expected callers.
Baseline normal Flow invocation frequency per Flow ID and alert on deviations that may indicate scripted abuse.

Monitoring Recommendations

Forward Directus application and reverse proxy logs to a centralized log platform and retain Flow trigger events for post-incident analysis.
Monitor outbound traffic generated by Flow operations (webhooks, email, third-party API calls) for unexpected destinations that could indicate abused Flows.
Track Directus version strings in deployment inventories and alert when instances remain on releases below 11.9.0.

How to Mitigate CVE-2025-53889

Immediate Actions Required

Upgrade all Directus instances to version 11.9.0 or later, which enforces permission checks on manual trigger Flows.
Review all Flows with a manual trigger and disable any that are not actively required by the application.
Audit directus_activity and directus_revisions for suspicious Flow executions since deployment of any version between 9.12.0 and 11.8.x.

Patch Information

The fix is delivered in Directus 11.9.0. The change is implemented in commit 22be460c76957708d67fdd52846a9ad1cbb083fb, which wires fetchPermissions and fetchPolicies into the Flows execution path so that the calling user's rights are evaluated before the Flow runs. See the GitHub Security Advisory GHSA-7cvf-pxgp-42fc and the GitHub Release v11.9.0 for release notes.

Workarounds

Implement explicit permission checks within each manual trigger Flow's first operation to verify read access to directus_flows and to the referenced collection or items before continuing.
Restrict network exposure of the Directus API so that Flow trigger endpoints are reachable only from authenticated internal callers until patching is complete.
Temporarily convert sensitive manual trigger Flows to webhook Flows that perform their own authorization checks against the caller context.

bash

# Verify the installed Directus version and upgrade to the fixed release
npm ls directus
npm install directus@11.9.0

# List Flows with manual triggers via the API for review
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
  "https://directus.example.com/flows?filter[trigger][_eq]=manual&fields=id,name,status,accountability"