{"id":"CVE-2025-30353","aliases":["EUVD-2025-8237","GHSA-fm3h-p9wm-h74h"],"status":"published","title":"Directus's webhook trigger flows can leak sensitive data","description":"Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the \"Webhook\" trigger and the \"Data of Last Operation\" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00526,"percentile":0.44924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2025-03-26T17:26:51Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"npm","package":"directus","fixed_in":["11.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"directus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.12.0"},{"fixed":"11.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"directus","ranges":[{"type":"SEMVER","events":[{"introduced":"9.12.0"},{"fixed":"11.5.0"}]}]}],"products":[{"vendor":"directus","product":"directus"},{"vendor":"monospace","product":"directus"}],"references":[{"url":"https://github.com/directus/directus/security/advisories/GHSA-fm3h-p9wm-h74h","tags":["x_refsource_CONFIRM","exploit","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30353","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fm3h-p9wm-h74h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30353.json","tags":["advisory"]},{"url":"https://github.com/directus/directus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-30353","title":"Directus's webhook trigger flows can leak sensitive data","description":"Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the \"Webhook\" trigger and the \"Data of Last Operation\" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.","status":"published","published":"2025-03-26T17:26:51.803Z","modified":"2025-03-26T17:44:22.29Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-8237","description":"Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the \"Webhook\" trigger and the \"Data of Last Operation\" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.","status":"published","published":"2025-03-26T17:26:51Z","modified":"2025-03-26T17:44:22Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:50.922534Z"}],"ghsa":[{"id":"GHSA-fm3h-p9wm-h74h","title":"Directus's webhook trigger flows can leak sensitive data","description":"### Describe the Bug\n\n In Directus, when a **Flow** with the \"_Webhook_\" trigger and the \"_Data of Last Operation_\" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.\n\nThis issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.\n\n![Image](https://github.com/user-attachments/assets/fb894347-cd10-4e79-9469-8fc1b2289794)\n![Image](https://github.com/user-attachments/assets/a20337a2-005f-4cfd-ba30-fc5f579ed6c4)\n![Image](https://github.com/user-attachments/assets/9b776248-4a20-46f0-92a4-3760d8e53df9)\n\n\n### To Reproduce\n\n**Steps to Reproduce:**\n1. Create a Flow in Directus with:\n   - Trigger: Webhook\n   - Response Body: Data of Last Operation\n2. Add a condition that is likely to fail.\n3. Trigger the Flow with any input data that will fail the condition.\n4. Observe the API response, which includes sensitive information like:\n   - Environmental variables (`$env`)\n   - Authorization headers\n   - User details under `$accountability`\n   - Previous operational data.\n\n**Expected Behavior:**\nIn the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.\n\n**Actual Behavior:**\nThe API response includes sensitive information such as:\n- Environment keys (`FLOWS_ENV_ALLOW_LIST`)\n- User accountability (`role`, `user`, etc.)\n- Operational logs (`current_payments`, `$last`), which might contain private details.","status":"published","published":"2025-03-26T20:08:58Z","modified":"2025-03-26T20:10:03Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2025-30353","description":"Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the \"Webhook\" trigger and the \"Data of Last Operation\" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.","status":"published","published":"2025-03-26T18:15:27.327Z","modified":"2026-06-17T09:08:34.137Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:55.858901Z"}],"osv":[{"id":"CVE-2025-30353","title":"Directus's webhook trigger flows can leak sensitive data","description":"Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.5.0, when a Flow with the \"Webhook\" trigger and the \"Data of Last Operation\" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data. This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse. Version 11.5.0 fixes the issue.","status":"published","published":"2025-03-26T17:26:51.803Z","modified":"2026-10-28T02:30:24.523723515Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-fm3h-p9wm-h74h","title":"Directus's webhook trigger flows can leak sensitive data","description":"### Describe the Bug\n\n In Directus, when a **Flow** with the \"_Webhook_\" trigger and the \"_Data of Last Operation_\" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.\n\nThis issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.\n\n![Image](https://github.com/user-attachments/assets/fb894347-cd10-4e79-9469-8fc1b2289794)\n![Image](https://github.com/user-attachments/assets/a20337a2-005f-4cfd-ba30-fc5f579ed6c4)\n![Image](https://github.com/user-attachments/assets/9b776248-4a20-46f0-92a4-3760d8e53df9)\n\n\n### To Reproduce\n\n**Steps to Reproduce:**\n1. Create a Flow in Directus with:\n   - Trigger: Webhook\n   - Response Body: Data of Last Operation\n2. Add a condition that is likely to fail.\n3. Trigger the Flow with any input data that will fail the condition.\n4. Observe the API response, which includes sensitive information like:\n   - Environmental variables (`$env`)\n   - Authorization headers\n   - User details under `$accountability`\n   - Previous operational data.\n\n**Expected Behavior:**\nIn the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.\n\n**Actual Behavior:**\nThe API response includes sensitive information such as:\n- Environment keys (`FLOWS_ENV_ALLOW_LIST`)\n- User accountability (`role`, `user`, etc.)\n- Operational logs (`current_payments`, `$last`), which might contain private details.","status":"published","published":"2025-03-26T20:08:58Z","modified":"2026-09-10T03:49:48.48347737Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}