CVE-2025-64748: Monospace Directus Information Disclosure

CVE-2025-64748 Overview

CVE-2025-64748 affects Directus, a real-time API and application dashboard for managing SQL database content. Versions prior to 11.13.0 allow authenticated users with read permissions to search across concealed (sensitive) fields. Although the returned values remain masked as ****, matching records are still returned in query results. Attackers can use this behavior to enumerate sensitive field values one character or token at a time. The issue is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data] and was fixed in Directus 11.13.0.

Critical Impact
Authenticated users can enumerate concealed field contents such as password hashes, tokens, or personally identifiable information by observing which records match search queries, even though the values themselves stay masked in responses.

Affected Products

Monospace Directus versions prior to 11.13.0
Directus Node.js distributions matching cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*
Self-hosted and cloud Directus deployments with concealed fields configured

Discovery Timeline

2025-11-13 - CVE-2025-64748 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64748

Vulnerability Analysis

Directus supports a conceal special flag on fields that masks their contents in API responses with ****. The concealment is applied at the output layer, protecting values from direct disclosure. However, the search subsystem in api/src/database/run-ast/lib/apply-query/search.ts iterated over all fields flagged as searchable, without excluding those marked with the conceal special.

As a result, any authenticated user with read permissions on a collection could issue a search query and receive filtered result sets that revealed whether a substring existed within a concealed field. Repeating this pattern with different substrings enables incremental extraction of sensitive values. The confidentiality impact is high, while integrity and availability remain unaffected.

Root Cause

The root cause is an inconsistency between output masking and query-time field filtering. The search builder honored the searchable attribute but ignored the conceal special flag. Fields intended to be hidden from consumers were still included in LIKE-style search predicates, exposing them to boolean-style enumeration through match/no-match responses.

Attack Vector

Exploitation requires an authenticated Directus account with read permissions on a collection that contains concealed fields. The attacker issues repeated search API requests with candidate substrings and observes which requests return records. This allows character-by-character or token-by-token reconstruction of masked values over the network without any user interaction.

typescript

// Patch: api/src/database/run-ast/lib/apply-query/search.ts
let fields = Object.entries(schema.collections[collection]!.fields);

// filter out fields that are not searchable
-fields = fields.filter(([_name, field]) => field.searchable !== false);
+fields = fields.filter(([_name, field]) => field.searchable !== false && field.special.includes('conceal') !== true);

const { cases, caseMap } = getCases(collection, permissions, []);

Source: Directus commit 7737d56. The fix adds an explicit check that excludes any field with the conceal special from the searchable set.

Detection Methods for CVE-2025-64748

Indicators of Compromise

High-volume search API requests from a single authenticated user targeting collections that contain concealed fields.
Sequential search queries with small, incrementing substring variations against the same collection endpoint.
Access log patterns showing many GET /items/<collection>?search= calls returning small, filtered result sets.

Detection Strategies

Correlate Directus API access logs with the collection schema to flag search queries that would be evaluated against fields marked with the conceal special.
Baseline normal search behavior per user and role, then alert on statistical anomalies in query rate or result-set entropy.
Review audit logs for authenticated accounts that suddenly begin querying collections containing credentials, tokens, or PII.

Monitoring Recommendations

Enable Directus activity and revision logging, and forward events to a centralized log store for retention and analytics.
Set rate limits on the /items and /search endpoints per user, and alert on threshold breaches.
Track authentication events for accounts with read access to sensitive collections and review token issuance regularly.

How to Mitigate CVE-2025-64748

Immediate Actions Required

Upgrade Directus to version 11.13.0 or later on all self-hosted and managed instances.
Audit role and permission assignments to minimize read access to collections containing concealed fields.
Rotate any credentials, tokens, or secrets stored in concealed fields that may have been exposed to enumeration.

Patch Information

The fix is delivered in Directus 11.13.0 via commit 7737d56. Full advisory details are available in the GitHub Security Advisory GHSA-8jpw-gpr4-8cmh. The patch updates the searchable-field filter to exclude any field whose special array includes conceal.

Workarounds

Temporarily set searchable: false on any field currently marked with the conceal special until upgrading is possible.
Restrict read permissions on sensitive collections to a minimal set of trusted service accounts.
Place Directus behind an API gateway or WAF that enforces per-user rate limits on search endpoints.

bash

# Upgrade Directus via npm
npm install directus@11.13.0

# Or upgrade the official Docker image
docker pull directus/directus:11.13.0
docker compose up -d directus

# Verify the running version
curl -s https://<your-directus-host>/server/info | jq '.data.directus.version'