What is CVE-2026-35442?

CVE-2026-35442 is a high-severity vulnerability in Directus, classified under Information Disclosure. CVSS score: 8.1/10. Published 2026-04-06.

How severe is CVE-2026-35442?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Directus

CVE-2026-35442

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked…

Vulnerability class: Information Disclosure

EPSS: 0.000 (4.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Directus — versions < 11.17.0

Weakness classification (CWE)

CWE-200 — Information Disclosure
CWE-863 — Incorrect Authorization

References

https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-35442?: CVE-2026-35442 is a high-severity vulnerability in Directus, classified under Information Disclosure. CVSS score: 8.1/10. Published 2026-04-06.
How severe is CVE-2026-35442?: High severity. CVSS v3 base score is 8.1 out of 10.