CVE-2026-39943

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline, sensitive fields (including user tokens, two-factor authentication secrets, external auth identifiers, auth data, stored credentials, and AI provider API keys) could be stored in plaintext within revision records. This vulnerability is fixed in 11.17.0.

• CWE-200
• CWE-312

• https://github.com/directus/directus/releases/tag/v11.17.0Product, Release Notes
• https://github.com/directus/directus/security/advisories/GHSA-mvv8-v4jj-g47jVendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39937Improper removal of sensitive information before storage or …8.8
• CVE-2026-39938Cacti is an open source performance and fault management fra…9.8
• CVE-2026-3994A vulnerability was detected in rui314 mold up to 2.40.4. Th…5.3
• CVE-2026-39940ChurchCRM is an open-source church management system. Prior …5.3
• CVE-2026-39941ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39942Directus is a real-time API and App dashboard for managing S…8.8
• CVE-2026-39946OpenBao is an open source identity-based secrets management …4.9
• CVE-2026-39948Cacti is an open source performance and fault management fra…9.8
• CVE-2026-3995The OPEN-BRAIN plugin for WordPress is vulnerable to Stored …4.4
• CVE-2026-39951Cacti is an open source performance and fault management fra…8.8
• CVE-2026-39955Cacti is an open source performance and fault management fra…9.8
• CVE-2026-39956jq is a command-line JSON processor. In commits after 69785b…6.1