Listen to this Post
How the CVE Works
Directus Flows with manual triggers fail to validate user permissions before execution. Unauthenticated attackers can manually trigger Flows by sending crafted requests, bypassing authentication checks. The system does not verify if the user has read access to `directus_flows` or the associated collections/items. This allows malicious actors to execute unintended actions, such as data manipulation or unauthorized operations, by exploiting improperly secured Flow endpoints.
DailyCVE Form
Platform: Directus
Version:
Vulnerability: Insufficient Permission Checks
Severity: Moderate
Date: Jul 14, 2025
Prediction: Patch expected by Aug 2025
What Undercode Say
curl -X POST "http://target/api/flows/trigger" -d '{"flow_id":"malicious_flow"}'
requests.post("http://target/api/flows/trigger", json={"flow_id":"exploit_flow"})
How Exploit
Attackers send unauthenticated POST requests to `/api/flows/trigger` with a malicious flow_id, triggering unauthorized operations.
Protection from this CVE
- Apply patches when released.
- Implement manual permission checks.
- Restrict Flow access.
Impact
Unauthenticated Flow execution leading to data breaches or system misuse.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
