CVE-2026-35413

{"id": "CVE-2026-35413", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35413", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:05:28.658796Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "directus", "product": "directus", "versions": [{"status": "affected", "version": "< 11.16.1"}]}]}], "published": "2026-04-06T22:16:22.540", "references": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-wxwm-3fxv-mrvx", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries (__schema, __type). However, the server_specs_graphql resolver on the /graphql/system endpoint returns an equivalent SDL representation of the schema and was not subject to the same restriction. This allowed the introspection control to be bypassed, exposing schema structure (collection names, field names, types, and relationships) to unauthenticated users at the public permission level, and to authenticated users at their permitted permission level. This vulnerability is fixed in 11.16.1."}, {"lang": "es", "value": "Directus es un API en tiempo real y panel de control de aplicaciones para gestionar contenido de bases de datos SQL. Antes de 11.16.1, cuando GRAPHQL_INTROSPECTION=false est\u00e1 configurado, Directus bloquea correctamente las consultas de introspecci\u00f3n GraphQL est\u00e1ndar (__schema, __type). Sin embargo, el resolvedor server_specs_graphql en el endpoint /graphql/system devuelve una representaci\u00f3n SDL equivalente del esquema y no estaba sujeto a la misma restricci\u00f3n. Esto permiti\u00f3 que se eludiera el control de introspecci\u00f3n, exponiendo la estructura del esquema (nombres de colecciones, nombres de campos, tipos y relaciones) a usuarios no autenticados en el nivel de permiso p\u00fablico, y a usuarios autenticados en su nivel de permiso permitido. Esta vulnerabilidad est\u00e1 corregida en 11.16.1."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E86A8769-F082-4253-9D48-B6B484CA61FF", "versionEndExcluding": "11.16.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}