CVE-2025-64746

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0

Description Directus does not properly remove field-level permissions when a field is deleted. When a field is removed from a collection, its reference in the permissions table is not cleared. This creates a security gap where a newly created field with the same name inherits outdated permission entries, potentially granting unintended access to data. This is especially concerning in multi-tenant or production environments where field names are reused.

Recommendations Update to version 11.13.0 or later.