CVE-2026-26185

Published: Feb 12, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.

Affected (1)

Products: Monospace: Directus

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Monospace Directus	Before 11.15.0

Related CWEs

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (4)

https://github.com/directus/directus/commit/e69aa7a5248c6e3e822cb1ac354dee295df90b2a

Source: security-advisories@github.com

Patch

https://github.com/directus/directus/pull/26485

Source: security-advisories@github.com

Issue Tracking

https://github.com/directus/directus/releases/tag/v11.14.1

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/directus/directus/security/advisories/GHSA-jr94-gj3h-c8rf

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.