Vulnerability · Published Feb 12, 2026 · Assigned by GitHub_M

CVE-2026-26185Directus Affected by User Enumeration via Password Reset Timing Attack

Medium 5.3

In plain English

A medium-severity security flaw in directus from directus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@directus/api	32.2.0	GHSA-jr94-gj3h-c8rf
npm	directus	11.14.1	GHSA-jr94-gj3h-c8rf

Affected products (as reported)

Vendor	Product	Versions
directus	directus	< 11.14.1
directus	@directus/api	< 32.2.0

Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/directus/directus/security/advisories/GHSA-jr94-gj3h-c8rf x_refsource_CONFIRM
https://github.com/directus/directus/pull/26485 x_refsource_MISC
https://github.com/directus/directus/commit/e69aa7a5248c6e3e822cb1ac354dee295df90b2a x_refsource_MISC
https://github.com/directus/directus/releases/tag/v11.14.1 x_refsource_MISC