Description
Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to access the API despite their status.
Recommendation
Update the @directus/types package to the latest compatible version. Followings are version details:
- Affected version(s): >= 11.0.7, < 13.0.0
- Patched version(s): 13.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Suspended Directus user can continue to use session token to access API and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OneUptime Unauthorized User Creation via API - CVE-2025-65966
- Turbo Frame responses can restore stale session cookies - CVE-2025-66803
- Unauthorized Access to Private Fields in User Registration API - CVE-2023-39345
- docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token - CVE-2025-53624
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2025