{"action":"Upgrade directus to 11.9.0 or later.","affected":[{"fixed":"11.9.0","introduced":"0"}],"component":"directus","cve_ids":["CVE-2025-53889"],"ecosystem":"npm","epss":0.00455,"exploited":false,"fixed_versions":["11.9.0"],"ghsa_id":"GHSA-7cvf-pxgp-42fc","id":"tcs_01M5KF9P2W8DV2S91CMG2AQ9JN","modified_at":"2025-07-15T16:27:19.078486Z","published_at":"2025-07-15T15:36:59Z","references":["https://osv.dev/vulnerability/GHSA-7cvf-pxgp-42fc","https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc","https://nvd.nist.gov/vuln/detail/CVE-2025-53889","https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb","https://github.com/directus/directus","https://github.com/directus/directus/releases/tag/v11.9.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-7cvf-pxgp-42fc","url":"https://osv.dev/vulnerability/GHSA-7cvf-pxgp-42fc"}],"summary":"Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows"}