GHSA-mvv8-v4jj-g47j

Source

https://github.com/advisories/GHSA-mvv8-v4jj-g47j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mvv8-v4jj-g47j/GHSA-mvv8-v4jj-g47j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mvv8-v4jj-g47j

Aliases

CVE-2026-39943

Published

2026-04-04T06:12:07Z

Modified

2026-04-09T19:19:00.341858Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Directus: Sensitive fields exposed in revision history

Details

Summary

Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records.

Impact

Any user or service account with read access to directus_revisions (or flow logs) could retrieve values for fields that are supposed to be concealed or encrypted at rest, including: - token, tfa_secret, external_identifier, auth_data, credentials - ai_openai_api_key, ai_anthropic_api_key, ai_google_api_key, ai_openai_compatible_api_key

This could lead to account takeover (via stolen tokens or 2FA secrets) or unauthorized use of third-party API keys stored against users.

Affected code paths

Item create/update revisions The data (snapshot) field written to directus_revisions was not processed through prepareDelta, so concealed/encrypted fields were stored without redaction. Relational fields were also included, which should have been excluded.
Authentication service When a user was auto-suspended after repeated failed login attempts, the revision record was created with the raw user object (including all sensitive fields) rather than the sanitized delta.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-04T06:12:07Z",
    "cwe_ids": [
        "CWE-200",
        "CWE-312"
    ],
    "severity": "MODERATE",
    "nvd_published_at": "2026-04-09T17:16:29Z"
}

References

Affected packages

npm / directus

Package

Name: directus; View open source insights on deps.dev
Purl: pkg:npm/directus

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

11.17.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-mvv8-v4jj-g47j/GHSA-mvv8-v4jj-g47j.json"