CVE-2025-64749: Directus Vulnerable to Information Leakage in Existing Collections

(updated )

An observable difference in error messaging was found in the Directus REST API. The /items/{collection} API returns different error messages for these two cases:

  1. A user tries to access an existing collection which they are not authorized to access.
  2. A user tries to access a non-existing collection.

The two differing error messages leak the existence of collections to users which are not authorized to access these collections.

References

Code Behaviors & Features

Detect and mitigate CVE-2025-64749 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →