A critical information disclosure vulnerability in Directus allows authenticated users to extract sensitive data, including API tokens and two-factor authentication secrets.

This vulnerability arises from improper authorization and sensitive data exposure, where aggregate functions (min, max) combined with groupBy queries return raw database values instead of masked placeholders for concealed fields. The vulnerability is exploitable by any authenticated user with read access to the target collection.

Successful exploitation of this flaw poses a severe risk to organizational security, as it allows attackers to retrieve highly sensitive credentials such as static API tokens and 2FA secrets. Given the CVSS score of 8.1, this vulnerability is classified as High severity, as it facilitates unauthorized access to administrative or user accounts, potentially leading to a full compromise of the database management system.

Immediate Action: Update the Directus installation to version 11.17.0 or later to apply the necessary authorization checks on aggregate functions.

Proactive Monitoring: Review database access logs for unusual aggregate queries, specifically those targeting the directus_users collection or fields marked with the conceal special type.

Compensating Controls: Implement strict role-based access control (RBAC) to limit user access to sensitive collections and monitor for unauthorized attempts to perform aggregate operations on concealed data.

Public Exploit Available: No (exploit_available: unknown)

The ability for authenticated users to extract administrative credentials and security tokens makes this a high-priority remediation item. IT administrators should audit current user permissions to minimize the blast radius while scheduling the deployment of version 11.17.0 immediately to resolve the underlying authorization flaw.