Vulnerability · Published Apr 9, 2026 · Assigned by GitHub_M

CVE-2026-39943Directus exposes sensitive fields in revision history

Medium 6.5

In plain English

A medium-severity information exposure in directus from directus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 93.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	directus	11.17.0	GHSA-mvv8-v4jj-g47j

Affected products (as reported)

Vendor	Product	Versions
directus	directus	< 11.17.0

Weakness: CWE-200, CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/directus/directus/security/advisories/GHSA-mvv8-v4jj-g47j x_refsource_CONFIRM
https://github.com/directus/directus/releases/tag/v11.17.0 x_refsource_MISC