CVE-2021-26593: Infoleak
UNSUPPORTED WHEN ASSIGNED In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information about the user (such as email address, first name, and last name) but also the secret for 2FA if one exists. This secret can be regenerated. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26593?
CVE-2021-26593 is a critical vulnerability due to the exposure of sensitive user information through the API.
How do I fix CVE-2021-26593?
To fix CVE-2021-26593, it is recommended to upgrade Directus to a version that is not affected, ideally beyond 8.8.1.
What information can be exposed due to CVE-2021-26593?
CVE-2021-26593 can expose user information including email addresses, names, and potentially the secret for two-factor authentication.
Is CVE-2021-26593 present in all versions of Directus?
CVE-2021-26593 affects Directus versions from 8.0.0 to 8.8.1.
Who is affected by CVE-2021-26593?
Any user or administrator utilizing Directus versions 8.0.0 to 8.8.1 is affected by CVE-2021-26593.