Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users. This vulnerability is fixed in 11.17.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-05 | 1 | Disclosure1 |
| 2026-04-06 | 1 | General1 |
| 2026-04-07 | 1 | Disclosure1 |
CVE-2026-35442 Information Disclosure in Directus Prior to 11.17.0 via Aggregate Functions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35442
Post summary
The text references CVE-2026-35442, an information‑disclosure flaw in Directus before version 11.17.0 triggered by aggregate functions, but it provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-35442 Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal s… https://www.cve.org/CVERecord?id=CVE-2026-35442
Post summary
The post cites the CVE and gives a brief technical snippet about aggregate function misuse, but does not provide PoC, exploit code, active exploitation claims, or patch information.
Authenticated users in `Directus` can extract concealed fields via aggregate queries (CVE-2026-35442). Review data visibility configurations and monitor for patches. #Directus #Infosec #DataPrivacy https://www.pulsepatch.io/posts/cve-2026-35442-directus-concealed-field-extraction
Post summary
The post announces CVE‑2026‑35442 in Directus, describing how authenticated users can extract hidden fields via aggregate queries and urges reviewing visibility settings while awaiting vendor patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | monospace | directus | - | node.js | - |