CVE-2025-53889: Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows

Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload to the Flow. Depending on what the Flow is set up to do this can lead to the Flow executing potential tasks on the attacker’s behalf without authenticating.