CVE-2025-64749: Directus Vulnerable to Information Leakage in Existing Collections

(updated )

An observable difference in error messaging was found in the Directus REST API. The /items/{collection} API returns different error messages for these two cases:

  1. A user tries to access an existing collection which they are not authorized to access.
  2. A user tries to access a non-existing collection.

The two differing error messages leak the existence of collections to users which are not authorized to access these collections.

References

Code Behaviors & Features

Detect and mitigate CVE-2025-64749 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →