Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.
References
| Link | Resource |
|---|---|
| https://github.com/directus/directus/releases/tag/v11.17.0 | Product Release Notes |
| https://github.com/directus/directus/security/advisories/GHSA-mvv8-v4jj-g47j | Vendor Advisory |
Configurations
History
14 Apr 2026, 17:34
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Monospace
Monospace directus |
|
| CPE | cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:* | |
| References | () https://github.com/directus/directus/releases/tag/v11.17.0 - Product, Release Notes | |
| References | () https://github.com/directus/directus/security/advisories/GHSA-mvv8-v4jj-g47j - Vendor Advisory |
09 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-09 17:16
Updated : 2026-04-14 17:34
NVD link : CVE-2026-39943
Mitre link : CVE-2026-39943
CVE.ORG link : CVE-2026-39943
JSON object : View
Products Affected
monospace
- directus