CVE-2026-35411

{"id": "CVE-2026-35411", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35411", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T13:36:55.274555Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "directus", "product": "directus", "versions": [{"status": "affected", "version": "< 11.16.1"}]}]}], "published": "2026-04-06T22:16:22.243", "references": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9x", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation. This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain. This vulnerability is fixed in 11.16.1."}, {"lang": "es", "value": "Directus es un API en tiempo real y un panel de control de aplicaciones para gestionar contenido de base de datos SQL. Antes de la versi\u00f3n 11.16.1, Directus es vulnerable a una redirecci\u00f3n abierta a trav\u00e9s del par\u00e1metro de consulta redirect en la p\u00e1gina /admin/tfa-setup. Cuando un administrador que a\u00fan no ha configurado la autenticaci\u00f3n de dos factores (2FA) visita una URL manipulada, se le presenta la p\u00e1gina leg\u00edtima de configuraci\u00f3n de 2FA de Directus. Despu\u00e9s de completar el proceso de configuraci\u00f3n, la aplicaci\u00f3n redirige al usuario a la URL controlada por el atacante especificada en el par\u00e1metro redirect sin ninguna validaci\u00f3n. Esta vulnerabilidad podr\u00eda usarse en ataques de phishing dirigidos a administradores de Directus, ya que la interacci\u00f3n inicial ocurre en un dominio de confianza. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 11.16.1."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E86A8769-F082-4253-9D48-B6B484CA61FF", "versionEndExcluding": "11.16.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}