CVE-2021-26593 Information disclosure in n/a

High 7.5 Published 23 Feb 2021 Updated 3 Aug 2024

Attackers can retrieve sensitive user data and 2FA secrets via the API, potentially leading to account takeover in the unsupported Directus CMS.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-26593?

CVE-2021-26593 is a high-severity vulnerability in n/a, published on 23 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information about the user (such as email address, first name, and last name) but also the secret for 2FA if one exists. This secret can be regenerated. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Weakness: CWE-200

Which versions are affected by CVE-2021-26593?

It affects 1 product.

Products include Rangerstudio Directus.

How do I fix CVE-2021-26593?

No fix has been published for CVE-2021-26593 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-26593 being exploited?

There is no known exploitation of CVE-2021-26593 in the wild and no public exploit code.

Sources

Also known as GHSA-rvr6-9222-46fm.