CVE-2026-39943 Directus exposes sensitive fields in revision history

What is CVE-2026-39943?

CVE-2026-39943 is a medium-severity vulnerability in Monospace Directus, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.

Weakness: CWE-312, CWE-200

Which versions are affected by CVE-2026-39943?

2 open source packages ship an affected version, including directus. It affects 1 product.

Products include Monospace Directus.

How do I fix CVE-2026-39943?

Upgrade directus to 11.17.0 or later.

Is CVE-2026-39943 being exploited?

There is no known exploitation of CVE-2026-39943 in the wild and no public exploit code.

Other vulnerabilities in Monospace Directus

• CVE-2022-26969 Insecure default value for CORS configuration Critical 9.8
• CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization Critical 9.3
• CVE-2026-35408 Directus is Missing Cross-Origin Opener Policy High 8.7
• CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key High 8.6
• CVE-2025-30353 Directus's webhook trigger flows can leak sensitive data High 8.6

All Monospace Directus vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mvv8-v4jj-g47j.