CVE-2026-26185 json
Directus Affected by User Enumeration via Password Reset Timing Attack
published 2026-02-12 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-6166 , GHSA-jr94-gj3h-c8rf
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.
Patch / fix
- npm directus 11.14.1
- npm @directus/api 32.2.0
- monospace directus 11.14.1
- rangerstudio directus 11.14.1
- monospace directus/api 32.2.0
- rangerstudio directus/api 32.2.0
- github.com/directus/directus@e69aa7a commit
- github.com/directus/directus#26485 pull request
- github.com/directus/directus/releases/tag/v11.14.1 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | directus | <11.14.1 |
11.14.1 |
| npm | @directus/api | <32.2.0 |
32.2.0 |
Affected products
- directus directus
- directus @directus/api
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
github.com
/directus/directus/pull/26485
web, issue-tracking
-
github.com
/directus/directus/commit/e69aa7a5248c6e3e822cb1ac354dee295df90b2a
web, patch
-
github.com
/directus/directus/security/advisories/GHSA-jr94-gj3h-c8rf
web, vendor-advisory
-
github.com
/directus/directus/releases/tag/v11.14.1
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-26185
advisory
-
github.com
/directus/directus
package
Sources
- CVE List CVE-2026-26185
- GitHub Advisory GHSA-jr94-gj3h-c8rf
- NVD CVE-2026-26185
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.