The vulnerability allows sensitive data such as user tokens, TOTP secrets, external auth identifiers, stored credentials, and AI provider API keys to be stored in plaintext within revision history records. This was due to the revision snapshot logic sometimes bypassing the sanitization pipeline, resulting in disclosure of confidential information. The weakness corresponds to CWE-200 (Information Exposure) and CWE-312 (Cleartext Storage of Sensitive Information).

Directus, versions before 11.17.0, where revision history records were not properly sanitized. The issue resolves in Directus 11.17.0 and later.

With a CVSS score of 6.5 the vulnerability carries a medium‑high impact. The EPSS score is below 1%, indicating a low likelihood of exploitation, and the problem is not listed in CISA's KEV catalog. The likely attack vector is through normal use of the API to create or update items that trigger revisions. An attacker with access to revision data—such as an insider or a compromised user—could obtain plaintext tokens and secrets.