{"id":"CVE-2025-30352","aliases":["GHSA-7wq3-jr35-275c"],"url":"https://o3.security/vulnerability/CVE-2025-30352","summary":"Directus `search` query parameter allows enumeration of non permitted fields","details":"Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the `search` query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents. The searchable columns (numbers & strings) are not checked against permissions when injecting the `where` clauses for applying the search query. This leads to the possibility of enumerating those un-permitted fields. Version 11.5.0 fixes the issue.","published":"2025-03-26T17:18:39.567Z","modified":"2026-07-15T01:49:05.061224635Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"directus","fixedVersion":"11.5.0"}],"fix":{"url":"https://github.com/directus/directus/commit/ac5a9964d9926f20dc063a74cb417dc7bbad676d","label":"directus/directus@ac5a996"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30352.json"},{"type":"ADVISORY","url":"https://github.com/directus/directus/security/advisories/GHSA-7wq3-jr35-275c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30352"},{"type":"FIX","url":"https://github.com/directus/directus/commit/ac5a9964d9926f20dc063a74cb417dc7bbad676d"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:05.061224635Z"}}