Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-26185 Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password … https://www.cve.org/CVERecord?id=CVE-2026-26185
Post summary
The text discloses a timing-based user enumeration vulnerability in Directus versions prior to 11.14.1.
CVE-2026-26185: Clockwatching: Enumerating Directus Users via Timing Side-Channels A logic error in the Directus password reset flow allows attackers to enumerate valid email addresses by measuring server response times. By manipulating the 'reset_url... https://cvereports.com/reports/CVE-2026-26185
Post summary
The report details a logic error in Directus’s password reset flow that enables enumeration of valid email addresses through timing side‑channels, but it offers no PoC, exploit, active‑use evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | monospace | directus | - | node.js | - |