CVE-2026-35413
GraphQL Introspection Bypass in Directus Exposes Schema Data
Publication date: 2026-04-06
Last updated on: 2026-04-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| monospace | directus | to 11.16.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Directus versions prior to 11.16.1 when the configuration GRAPHQL_INTROSPECTION=false is set. Although standard GraphQL introspection queries (__schema, __type) are blocked as intended, the server_specs_graphql resolver on the /graphql/system endpoint still returns an equivalent schema representation. This bypasses the introspection restriction and exposes the database schema structure, including collection names, field names, types, and relationships.
The exposure occurs to unauthenticated users at the public permission level and to authenticated users at their permitted permission level.
This issue was fixed in Directus version 11.16.1.
How can this vulnerability impact me? :
The vulnerability allows unauthorized users to gain access to the database schema structure, which includes collection names, field names, types, and relationships.
This exposure can aid attackers in understanding the database layout, potentially facilitating further attacks such as data extraction, privilege escalation, or targeted exploitation.
Since the vulnerability has a CVSS base score of 5.3 with network attack vector and no privileges required, it represents a moderate risk.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Directus to version 11.16.1 or later, where the issue is fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes the schema structure of the database, including collection names, field names, types, and relationships, to unauthenticated and authenticated users beyond intended restrictions.
Such exposure of database schema information could potentially increase the risk of unauthorized data access or data leakage, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding sensitive data and limiting access.
However, the CVE description does not explicitly mention compliance impacts or regulatory considerations.