CVE-2026-39943: Directus exposes sensitive fields in revision history
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directusrevisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39943?
CVE-2026-39943 has been classified as a medium severity vulnerability due to the exposure of sensitive data.
How do I fix CVE-2026-39943?
To mitigate CVE-2026-39943, upgrade Directus to version 11.17.0 or later.
Who is affected by CVE-2026-39943?
CVE-2026-39943 affects all versions of Directus prior to 11.17.0.
What is the impact of CVE-2026-39943?
The impact of CVE-2026-39943 is the potential exposure of sensitive fields in the revision history.
How can I check if I am using a vulnerable version related to CVE-2026-39943?
You can check your Directus version and confirm if it is below 11.17.0 to determine if it is vulnerable to CVE-2026-39943.