CVE-2025-30351: Suspended Directus user can continue to use session token to access API

March 26, 2025 (updated June 9, 2025)

Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status.

References

github.com/advisories/GHSA-56p6-qw3c-fq2g
github.com/directus/directus
github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771
github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2g
nvd.nist.gov/vuln/detail/CVE-2025-30351

Code Behaviors & Features

Detect and mitigate CVE-2025-30351 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →