CVE-2025-24353

When sharing an item, user can specify an arbitrary role. It allows user to use a higher-privileged role to see fields that otherwise the user should not be able to see.

Details

Specifying role on share should be available only for admins. The current flow has a security flaw.

Each other role should allow to share only in the context of the same role. As there is no role hierarchy in Directus, it is impossible to tell which role is higher or lower, so only admins should be able to specify the role for share.

Optionally, instead of specifying a role, shareer* should be able to specify which fields (limited to fields shareer sees) are available on shared item. Similarily to import.

*shareer - a person that creates a share link to item

PoC

1. Create a collection with a secret field.
2. Create role A that sees the secret field
3. Create role B that does not see the secret field, but can use share feature.
4. Create item with secret field filled.
5. Use account with role B to share the object as role A and gain unauthorized access to secret value.

Here's video example: https://www.youtube.com/watch?v=DbV4IxbWzN4
I had to upload it to YouTube, because GitHub allows only 10MB videos.

Impacted are instances that use the share feature and have specific roles hierarchy and fields that are not visible for certain roles.

The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access. Typical impact: privilege escalation beyond the intended level.

CVE-2025-24353 has a CVSS score of 5.0 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (11.2.0, 13.3.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2025-24353? CVE-2025-24353 is a medium-severity improper privilege management vulnerability in directus (npm), affecting versions < 11.2.0. It is fixed in 11.2.0, 13.3.1. The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access.
2. How severe is CVE-2025-24353? CVE-2025-24353 has a CVSS score of 5.0 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by CVE-2025-24353?
   • directus (npm) (versions < 11.2.0)
   • @directus/app (npm) (versions < 13.3.1)
4. Is there a fix for CVE-2025-24353? Yes. CVE-2025-24353 is fixed in 11.2.0, 13.3.1. Upgrade to this version or later.
5. Is CVE-2025-24353 exploitable, and should I be worried? Whether CVE-2025-24353 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2025-24353 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2025-24353?
   • Upgrade directus to 11.2.0 or later
   • Upgrade @directus/app to 13.3.1 or later

Other vulnerabilities in directus