Executive Summary

This vulnerability exists in Directus versions prior to 11.16.1 when the configuration GRAPHQL_INTROSPECTION=false is set. Although standard GraphQL introspection queries (__schema, __type) are blocked as intended, the server_specs_graphql resolver on the /graphql/system endpoint still returns an equivalent schema representation. This bypasses the introspection restriction and exposes the database schema structure, including collection names, field names, types, and relationships.

The exposure occurs to unauthenticated users at the public permission level and to authenticated users at their permitted permission level.

This issue was fixed in Directus version 11.16.1.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthorized users to gain access to the database schema structure, which includes collection names, field names, types, and relationships.

This exposure can aid attackers in understanding the database layout, potentially facilitating further attacks such as data extraction, privilege escalation, or targeted exploitation.

Since the vulnerability has a CVSS base score of 5.3 with network attack vector and no privileges required, it represents a moderate risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Directus to version 11.16.1 or later, where the issue is fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes the schema structure of the database, including collection names, field names, types, and relationships, to unauthenticated and authenticated users beyond intended restrictions.

Such exposure of database schema information could potentially increase the risk of unauthorized data access or data leakage, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding sensitive data and limiting access.

However, the CVE description does not explicitly mention compliance impacts or regulatory considerations.

Useful 0 Not Useful 0