Suspended Directus user can continue to use session token to access API

Description

Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status.

Recommendation

Update the @directus/types package to the latest compatible version. Followings are version details:

• Affected version(s): >= 11.0.7, < 13.0.0
• Patched version(s): 13.0.0

References

• GHSA-56p6-qw3c-fq2g
• CVE-2025-30351
• CWE-672
• CAPEC-310
• OWASP 2021-A6

Related Issues

• OneUptime Unauthorized User Creation via API - CVE-2025-65966
• Turbo Frame responses can restore stale session cookies - CVE-2025-66803
• Unauthorized Access to Private Fields in User Registration API - CVE-2023-39345
• docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token - CVE-2025-53624

You might also like:

How to Use SmartScanner for Securing Your Node.js Applications

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@directus/types