CVE-2026-35442
High
Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users. This vulnerability is fixed in 11.17.0.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Monospace Directus
PublishedApr 6, 2026
First seenApr 6, 2026
How to fix
Update
- monospace directus11.17.0 or later
- directus11.17.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| monospace directus | v < 11.17.0 | 11.17.0 |
| directusnpm | v < 11.17.0 | 11.17.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.