CVE-2026-35442: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35442 is a high-severity information disclosure vulnerability in Directus, an open-source headless CMS and data platform, titled "Authenticated Users Can Extract Concealed Fields via Aggregate Queries." It affects all versions of the directus npm package prior to 11.17.0 and was published on April 2, 2026, with the GitHub Advisory Database entry added April 4, 2026. The flaw allows any authenticated user with read access to extract sensitive concealed field values — including static API tokens and TOTP 2FA secrets — from directus_users and other collections. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Directus Advisory).

The root cause is a flaw in Directus's payload masking logic (CWE-200, CWE-863): fields marked with the conceal special type are protected by a masking layer that replaces real values with a placeholder on read. However, aggregate query responses structure results differently — operations like min and max nest field values under their function name rather than as flat field keys. The masking logic does not account for this nested structure, causing it to silently skip concealed fields in aggregate responses and return raw database values to the caller. An attacker exploits this by issuing an authenticated API request using aggregate functions (min/max) combined with groupBy against a collection containing concealed fields, such as directus_users (GitHub Advisory, Directus Advisory).

Successful exploitation enables any low-privileged authenticated user to extract raw values of concealed fields across all accessible collections. The most critical impact targets directus_users: an attacker can harvest static API tokens for all users — including administrators — enabling immediate account takeover without knowing passwords. Additionally, TOTP seeds stored in directus_users can be extracted, allowing complete bypass of two-factor authentication for any account. The vulnerability has high confidentiality and integrity impact with no availability impact (GitHub Advisory, Directus Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires only low-level authenticated access (any valid account with read permissions to the target collection), making it accessible to a broad range of potential attackers. The EPSS score is approximately 0.018% (5th percentile), indicating a currently low probability of exploitation within 30 days. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (GitHub Advisory).

1. Authenticate: Obtain any valid low-privileged account on the target Directus instance (e.g., a standard user account with read access to directus_users or another collection with concealed fields).
2. Identify target collection: Determine which collections contain fields with the conceal special type — directus_users is a primary target as it stores static API tokens (token) and TOTP secrets (tfa_secret).
3. Craft aggregate query: Send an authenticated HTTP GET or POST request to the Directus Items API using aggregate functions (min or max) combined with groupBy on the concealed field. For example:

   GET /items/directus_users?aggregate[min]=token&groupBy[]=id
   Authorization: Bearer <low_priv_token>

4. Extract raw values: Parse the API response — instead of the masked placeholder, the response will contain the raw database values of the concealed field (e.g., plaintext static API tokens or TOTP seeds) for each grouped record.
5. Escalate privileges: Use harvested administrator API tokens to authenticate as an admin user, or use extracted TOTP seeds to generate valid 2FA codes and bypass multi-factor authentication for any account (GitHub Advisory, Directus Advisory).

• Network: Unusual authenticated API requests to Directus item endpoints containing aggregate[min] or aggregate[max] query parameters targeting directus_users or other sensitive collections; requests including both aggregate and groupBy parameters from low-privileged user accounts.
• Logs: Directus access logs showing repeated aggregate queries (e.g., GET /items/directus_users?aggregate[min]=token&groupBy[]=id) from accounts that do not normally perform such queries; API activity from user accounts immediately followed by admin-level actions suggesting token harvesting.
• Authentication Events: Unexpected logins or API token usage from accounts that were not previously active, particularly admin accounts; successful 2FA completions from unusual IP addresses or at unusual times, potentially indicating use of extracted TOTP seeds.

Directus has released version 11.17.0 which patches this vulnerability by correcting the masking logic to account for the nested structure of aggregate query responses. All users running versions prior to 11.17.0 should upgrade immediately (GitHub Advisory, Directus Advisory). As a temporary workaround until patching is possible, restrict read access to collections containing concealed fields (especially directus_users) to only essential authenticated users, minimizing the pool of accounts that could exploit this flaw (Feedly). Additionally, consider rotating all static API tokens and TOTP secrets stored in directus_users as a precautionary measure if exploitation cannot be ruled out.

The vulnerability was discovered and reported by researcher br41nslug and published to the Directus GitHub security advisories on April 2, 2026 (Directus Advisory). Brief mentions appeared on Mastodon via The Hacker Wire and on Bluesky shortly after the CVE was published to the NVD, indicating moderate community awareness. No significant vendor statements beyond the official advisory or major media coverage have been identified at this time.