CVE-2025-24353: Privilege Escalation in Directus

An attacker exploiting this vulnerability can bypass role-based access controls within Directus. By crafting a malicious item sharing request with an elevated role, an attacker can gain unauthorized access to sensitive data fields that are normally restricted to higher-privileged users. This could lead to data breaches, unauthorized modifications, or even complete compromise of the Directus instance, depending on the data stored and the roles involved. The impact is particularly severe in environments where sensitive data is stored and access controls are critical for compliance or security.

1. Reserved2025-01-20
2. Published2025-01-23
3. Modified2025-02-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-24353 is to upgrade Directus to version 11.2.0 or later, which includes the necessary patch. If immediate upgrading is not possible, consider restricting the use of the item sharing feature until the upgrade can be performed. Review existing role configurations and ensure that the hierarchy is properly defined to prevent unintended privilege escalation. Implement strict input validation on all user-provided data, especially when dealing with role assignments. After upgrading, confirm the fix by attempting to share an item with a lower-privileged user and verifying that access to restricted fields is denied.