Skip to content
Log inStart free trial

GHSA-56p6-qw3c-fq2g CVE-2025-30351

Suspended Directus user can continue to use session token to access API

Medium npm
Severity
3.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.37%
Chance of exploitation in the next 30 days. Higher than 31.35% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-672 Operation on a Resource after Expiration or Release
Fix
Available
3 packages have a fixed version

Description

Summary

Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status.

Details

There is a check missing in verifySessionJWT to verify that a user is actually still active and allowed to access the API. Right now one can extract the session token obtained by, e.g. login in to the app while still active and then, after the user has been suspended continue to use that token until it expires.

PoC

  • Create an active user
  • Log in with that user and note the session cookie
  • Suspend the user (and don't trigger an /auth/refresh call, as that invalidates the session
  • Access the API with Authorization: Bearer <token>

Impact

This weakens the security of suspending users.

Affected versions

npm

PackageVulnerableFixed in
@directus/api
>= 18.0.0, < 24.0.1
24.0.1
@directus/types
>= 11.0.7, < 13.0.0
13.0.0
directus
>= 10.10.0, < 11.5.0
11.5.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

@directus/api npm → 24.0.1

npm
npm install @directus/api@24.0.1
yarn
yarn add @directus/api@24.0.1
pnpm
pnpm add @directus/api@24.0.1

@directus/types npm → 13.0.0

npm
npm install @directus/types@13.0.0
yarn
yarn add @directus/types@13.0.0
pnpm
pnpm add @directus/types@13.0.0

directus npm → 11.5.0

npm
npm install directus@11.5.0
yarn
yarn add directus@11.5.0
pnpm
pnpm add directus@11.5.0

Severity breakdown

CVSS 3.1 3.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Weakness

CWE-672: Operation on a Resource after Expiration or Release

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-c6w9-5g5j-jh2p
Directus: Authorization-dependent response served from unsegmented cache key
High Also affects directus
GHSA-j5h6-vqc3-phqh
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
High Also affects directus
GHSA-38hg-ww64-rrwc
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries
High Also affects directus
GHSA-6q22-g298-grjh
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
High Also affects directus
GHSA-ph52-67fq-75wj
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits
Medium Also affects directus
GHSA-mvv8-v4jj-g47j
Directus: Sensitive fields exposed in revision history
Medium Also affects directus
GHSA-qqmv-5p3g-px89
Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite
High Also affects directus
GHSA-wv3h-5fx7-966h
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
High Also affects directus
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor