PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35413 directus CVE debrief

CVE-2026-35413 is a vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. Prior to version 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus incorrectly exposes schema structure to unauthenticated users at the public permission level and to authenticated users at their permitted permission level via the /graphql/system endpoint. This issue is fixed in version 11.16.1. The vulnerability allows access to collection names, field names, types, and relationships, potentially leading to information disclosure.

Vendor
directus
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of Directus versions prior to 11.16.1 should apply the patch to prevent unauthorized access to schema structure. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess and mitigate the vulnerability.

Technical summary

The Directus application, a real-time API and App dashboard for managing SQL database content, had a vulnerability prior to version 11.16.1. When the GRAPHQL_INTROSPECTION=false configuration was set, the application should have blocked standard GraphQL introspection queries. However, the server_specs_graphql resolver on the /graphql/system endpoint returned an equivalent SDL representation of the schema, bypassing the introspection control. This allowed unauthenticated users at the public permission level and authenticated users at their permitted permission level to access schema structure, including collection names, field names, types, and relationships.

Defensive priority

Medium priority due to the potential for information disclosure.

Recommended defensive actions

  • Apply the patch by upgrading to Directus version 11.16.1 or later.
  • Review and adjust the GRAPHQL_INTROSPECTION configuration.
  • Monitor for and restrict unauthorized access to the /graphql/system endpoint.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-06T22:16:22.540Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. Evidence limits suggest that affected scope and vendor guidance should be verified. Defenders should review official advisories for mitigation steps and track exceptions for remediated assets.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-06T22:16:22.540Z and has not been modified since then. The NVD entry is currently Analyzed.