{"id":"CVE-2026-26185","aliases":["GHSA-jr94-gj3h-c8rf"],"url":"https://o3.security/vulnerability/CVE-2026-26185","summary":"Directus Affected by User Enumeration via Password Reset Timing Attack","details":"Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.","published":"2026-02-12T21:54:13.901Z","modified":"2026-08-05T03:47:20.978539077Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"directus","fixedVersion":"11.14.1"},{"ecosystem":"npm","name":"@directus/api","fixedVersion":"32.2.0"}],"fix":{"url":"https://github.com/directus/directus/commit/e69aa7a5248c6e3e822cb1ac354dee295df90b2a","label":"directus/directus@e69aa7a"},"references":[{"type":"WEB","url":"https://github.com/directus/directus/releases/tag/v11.14.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26185.json"},{"type":"ADVISORY","url":"https://github.com/directus/directus/security/advisories/GHSA-jr94-gj3h-c8rf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26185"},{"type":"FIX","url":"https://github.com/directus/directus/commit/e69aa7a5248c6e3e822cb1ac354dee295df90b2a"},{"type":"FIX","url":"https://github.com/directus/directus/pull/26485"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-05T03:47:20.978539077Z"}}