CVE-2026-35442

Authenticated user with read access to a Directus collection containing fields marked with conceal type. Attacker executes aggregate functions (min, max) combined with groupBy queries to extract concealed values like API tokens and 2FA secrets from directus_users table.

This vulnerability presents critical real-world risk despite the CVSS 8.1 score understating true impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity requiring only authenticated low-privilege access, meaning any legitimate user account can extract all authentication secrets. The High confidentiality impact and High integrity impact (account takeover enables unauthorized modification) are accurate, though Availability impact should arguably be rated given that harvested admin credentials enable destructive actions. No EPSS score provided in input data, but the combination of low attack complexity, clear exploitation steps in the advisory, and high-value targets (authentication bypass primitives) suggests elevated exploitation probability once awareness spreads. CISA KEV status is negative, indicating no confirmed active exploitation at time of analysis. The SSVC decision framework would rate this as high priority: exploitation status is publicly documented with detailed technique description (though no POC code), the attack is fully automatable via API requests, and technical impact is total credential compromise. The primary risk mitigation is that exploitation requires existing authenticated access, but in multi-tenant or large-organization deployments where low-privilege read access is broadly granted, this barrier is minimal. Any Directus instance exposing the directus_users collection to authenticated users faces immediate risk of complete authentication system compromise.

An attacker with a low-privilege authenticated account (such as a content editor or read-only API consumer) crafts an aggregate query targeting the directus_users collection, using min() or max() functions against the token or tfa_secret fields combined with groupBy clauses to enumerate all values. Because the concealment masking logic fails to process the nested aggregate response structure, the query returns raw database values instead of masked placeholders. The attacker extracts static API tokens for administrator accounts, then authenticates directly to the Directus API with full admin privileges, bypassing password requirements. Alternatively, they harvest TOTP seeds, generate valid time-based codes using standard authenticator algorithms, and defeat two-factor authentication protections during login. No public proof-of-concept code exists at time of analysis, but the attack technique is fully documented in the security advisory with sufficient detail for reproduction.