GHSA-f24x-rm6g-3w5v

Suggest an improvement
Source
https://github.com/advisories/GHSA-f24x-rm6g-3w5v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-f24x-rm6g-3w5v/GHSA-f24x-rm6g-3w5v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f24x-rm6g-3w5v
Aliases
Published
2025-07-15T15:28:26Z
Modified
2025-07-15T16:12:14Z
Severity
  • 4.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Directus tokens are not redacted in flow logs, exposing session credentials to all admin
Details

Summary

When using Directus Flows with the WebHook trigger, all incoming request details are logged including security sensitive data like access and refresh tokens in cookies.

Impact

Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow.

Database specific 
{
    "cwe_ids":  [
        "CWE-200",
        "CWE-532"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-07-15T15:28:26Z",
    "nvd_published_at":  "2025-07-15T00:15:23Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / directus

Package

Name
directus
View open source insights on deps.dev
Purl
pkg:npm/directus

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.9.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-f24x-rm6g-3w5v/GHSA-f24x-rm6g-3w5v.json"