Directus, an API and dashboard platform, had a flaw in aggregate functions where fields designated as concealed returned their raw database values instead of a masked placeholder. This allowed any user with read access to a collection to use min or max functions combined with groupBy to retrieve sensitive data such as API tokens and two‑factor authentication secrets stored in concealed fields. The vulnerability results in direct disclosure of confidential information, matching CWE‑200 and CWE‑863.

All installations of Directus running any version prior to 11.17.0 are affected, including the 11.x series up to 11.16.9. The issue is specific to the directus:directus product listed by the CNA and impacts collections where fields are marked as concealed.

The CVSS score of 8.1 classifies this as high severity. Although EPSS data is not available and it is not listed in the KEV catalog, the flaw requires only authenticated read access, which many users already possess. Therefore, the risk of exploitation remains significant, especially for organizations with broad read permissions on sensitive collections.