CVE-2025-53886

Directus doesn't redact tokens in Flow logs

State: Published
Severity: 4.5 Medium
Published: Jul 14, 2025
Updated: Jul 15, 2025
Reserved: Jul 11, 2025

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow. Version 11.9.0 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	4.5 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
CWE-532 Insertion of Sensitive Information into Log File

Affected Products

Product	Versions
directusdirectus	>= 9.0.0, < 11.9.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.