{"id":"CVE-2026-26185","aliases":["EUVD-2026-6166","GHSA-jr94-gj3h-c8rf"],"status":"published","title":"Directus Affected by User Enumeration via Password Reset Timing Attack","description":"Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00388,"percentile":0.33307,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203"],"published":"2026-02-12T21:54:13Z","modified":"2026-11-04T02:47:38Z","fixes":[{"ecosystem":"npm","package":"directus","fixed_in":["11.14.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@directus/api","fixed_in":["32.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"directus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.14.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@directus/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"32.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"directus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.14.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@directus/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"32.2.0"}]}]}],"products":[{"vendor":"directus","product":"@directus/api"},{"vendor":"directus","product":"directus"},{"vendor":"monospace","product":"directus"}],"references":[{"url":"https://github.com/directus/directus/security/advisories/GHSA-jr94-gj3h-c8rf","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/directus/directus/pull/26485","tags":["x_refsource_MISC","Issue Tracking","fix","web"]},{"url":"https://github.com/directus/directus/commit/e69aa7a5248c6e3e822cb1ac354dee295df90b2a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/directus/directus/releases/tag/v11.14.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26185","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jr94-gj3h-c8rf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26185.json","tags":["advisory"]},{"url":"https://github.com/directus/directus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-26185","title":"Directus Affected by User Enumeration via Password Reset Timing Attack","description":"Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.","status":"published","published":"2026-02-12T21:54:13.901Z","modified":"2026-02-13T15:59:06.336Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-6166","description":"Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.","status":"published","published":"2026-02-12T21:54:13Z","modified":"2026-02-13T15:59:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:39.919829Z"}],"ghsa":[{"id":"GHSA-jr94-gj3h-c8rf","title":"Directus Vulnerable to User Enumeration via Password Reset Timing Attack","description":"### Summary\n\nA timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration.\n\n### Details\n\nThe password reset endpoint implements a timing protection mechanism to prevent user enumeration; however, URL validation executes before the timing protection is applied. This allows an attacker to distinguish between valid and invalid user accounts based on response timing differences.\n\n### Impact\n\nThis vulnerability violates user privacy and may facilitate targeted phishing attacks by allowing attackers to confirm the existence of user accounts.","status":"published","published":"2026-02-12T22:13:04Z","modified":"2026-02-13T17:15:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"nvd":[{"id":"CVE-2026-26185","description":"Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.","status":"published","published":"2026-02-12T22:16:07.1Z","modified":"2026-06-17T10:25:54.293Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"CVE-2026-26185","title":"Directus Affected by User Enumeration via Password Reset Timing Attack","description":"Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.","status":"published","published":"2026-02-12T21:54:13.901Z","modified":"2026-11-11T02:30:43.940651247Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-11T11:06:42.880804Z"},{"id":"GHSA-jr94-gj3h-c8rf","title":"Directus Vulnerable to User Enumeration via Password Reset Timing Attack","description":"### Summary\n\nA timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration.\n\n### Details\n\nThe password reset endpoint implements a timing protection mechanism to prevent user enumeration; however, URL validation executes before the timing protection is applied. This allows an attacker to distinguish between valid and invalid user accounts based on response timing differences.\n\n### Impact\n\nThis vulnerability violates user privacy and may facilitate targeted phishing attacks by allowing attackers to confirm the existence of user accounts.","status":"published","published":"2026-02-12T22:13:04Z","modified":"2026-02-13T17:48:48.075974Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:46:50.687609Z"}]}}