What is the CVSS score of CVE-2026-39943?

CVE-2026-39943 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-39943?

Yes, a patch is available for CVE-2026-39943. Update the affected software to the latest version immediately.

Directus CVE-2026-39943

EUVD-2026-20952 MEDIUM

Information Exposure (CWE-200)

2026-04-09 GitHub_M

Information Disclosure Directus

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 09, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 16:30 euvd

EUVD-2026-20952

Analysis Generated

Apr 09, 2026 - 16:30 vuln.today

CVE Published

Apr 09, 2026 - 16:12 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on directus (1 direct, 2 indirect)

Ecosystem-wide dependent count for version 11.17.0.

DescriptionGitHub Advisory

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.

AnalysisAI

Directus before 11.17.0 stores sensitive authentication and credential data in plaintext within revision records due to incomplete sanitization of revision snapshots, allowing authenticated users with database access to retrieve user tokens, 2FA secrets, external auth identifiers, and API keys from the directus_revisions table. The vulnerability affects all versions before 11.17.0 and requires low-privilege authenticated access to exploit; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Directus maintains a revision history system stored in the directus_revisions table that captures snapshots of item changes for audit and recovery purposes. The vulnerability stems from the revision snapshot serialization code failing to consistently invoke the prepareDelta sanitization pipeline, which is responsible for scrubbing sensitive field types (PR:L in CVSS indicates authenticated access is required). The root cause is improper input validation and data handling (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) where the revision system bypasses the normal field-level security controls that would otherwise mask or exclude sensitive data during storage. Affected is the entire Directus product line via cpe:2.3:a:directus:directus:*:*:*:*:*:*:*:* prior to version 11.17.0.

RemediationAI

Vendor-released patch: Upgrade Directus to version 11.17.0 or later, which fixes the prepareDelta sanitization pipeline to consistently scrub sensitive fields from revision snapshots. Detailed guidance is available in the GitHub security advisory at https://github.com/directus/directus/security/advisories/GHSA-mvv8-v4jj-g47j and the release notes at https://github.com/directus/directus/releases/tag/v11.17.0. Organizations unable to upgrade immediately should audit their directus_revisions table for plaintext sensitive data (tokens, secrets, API keys) and consider implementing database-level access controls to restrict read permissions on the revisions table to trusted administrators only. Post-patch, existing revision records containing sensitive plaintext should be purged or re-encrypted if retention is required for compliance.