{"action":"Upgrade directus to 11.13.0 or later.","affected":[{"fixed":"11.13.0","introduced":"0"}],"component":"directus","cve_ids":["CVE-2025-64746"],"ecosystem":"npm","epss":0.00205,"exploited":false,"fixed_versions":["11.13.0"],"ghsa_id":"GHSA-9x5g-62gj-wqf2","id":"tcs_01M5KFH97SYPM814FZ3S96XC11","modified_at":"2025-11-14T21:45:15Z","published_at":"2025-11-14T21:45:15Z","references":["https://osv.dev/vulnerability/GHSA-9x5g-62gj-wqf2","https://github.com/directus/directus/security/advisories/GHSA-9x5g-62gj-wqf2","https://nvd.nist.gov/vuln/detail/CVE-2025-64746","https://github.com/directus/directus/commit/84d7636969083387164ce5d2fd15a65e11e2d0b8","https://github.com/directus/directus"],"severity":{"label":"medium","score":4.6},"sources":[{"source":"osv","source_id":"GHSA-9x5g-62gj-wqf2","url":"https://osv.dev/vulnerability/GHSA-9x5g-62gj-wqf2"}],"summary":"Directus has Improper Permission Handling on Deleted Fields"}