CVE-2025-53889
mediumpriority · track · 0EPSS 0.005 · 39 %ileEUUSEPSS · scored 2026-10-27
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload to the Flow. Depending on what the Flow is set up to do this can lead to the Flow executing potential tasks on the attacker's behalf without authenticating. Bad actors could execute the manual trigger Flows without authentication, or access rights to the said collection(s) or item(s). Users with manual trigger Flows configured are impacted as these endpoints do not currently validate if the user has read access to `directus_flows` or to the relevant collection/items. The manual trigger Flows should have tighter security requirements as compared to webhook Flows where users are expected to perform do their own checks. Version 11.9.0 fixes the issue. As a workaround, implement permission checks for read access to Flows and read access to relevant collection/items.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-7cvf-pxgp-42fcDirectus' insufficient permission checks can enable unauthenticated users to manually trigger Flows2025-07-15ghsa · osvUS
### Summary Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload to the Flow. Depending on what the Flow is set up to do this can lead to the Flow executing potential tasks on the attacker's behalf without authenticating. ### Impact Bad actors could execute the manual trigger Flows without authentication, or access rights to the said collection(s) or item(s). Users with manual trigger Flows configured are impacted as these endpoints do not currently validate if the user has read access to `directus_flows` or to the relevant collection/items. The manual trigger Flows should have tighter security requirements as compared to webhook Flows where users are expected to perform do their own checks. ### Workarounds Users have to implement permission checks for read access to Flows and read access to relevant collection/items.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-53889cnnvd
- https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fbcnnvd
- https://github.com/directus/directus/releasesPatchcnnvd
- https://github.com/directus/directus/releases/tag/v11.9.0cnnvd
- https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fccnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-53889cnnvd
- https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fbenisa_euvd
- https://github.com/directus/directus/releases/tag/v11.9.0enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan