directus @directus/types vulnerabilities

Latest directus @directus/types CVEs

Newest publication first

1. CVE-2025-30351 Suspended Directus user can continue to use session token to access API

   Published 2025-03-26

   Medium·CVSS 4.3 EPSS 0.37%

   Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a chec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.