{"action":"Upgrade directus to 11.9.0 or later.","affected":[{"fixed":"11.9.0","introduced":"0"}],"component":"directus","cve_ids":["CVE-2025-53886"],"ecosystem":"npm","epss":0.00459,"exploited":false,"fixed_versions":["11.9.0"],"ghsa_id":"GHSA-f24x-rm6g-3w5v","id":"tcs_01M5KFM31GP0YJC4CJJXPCDJBX","modified_at":"2025-07-15T16:12:14.717635Z","published_at":"2025-07-15T15:28:26Z","references":["https://osv.dev/vulnerability/GHSA-f24x-rm6g-3w5v","https://github.com/directus/directus/security/advisories/GHSA-f24x-rm6g-3w5v","https://nvd.nist.gov/vuln/detail/CVE-2025-53886","https://github.com/directus/directus/commit/859f664f56fb50401c407b095889cea38ff580e5","https://github.com/directus/directus","https://github.com/directus/directus/releases/tag/v11.9.0"],"severity":{"label":"medium","score":4.5},"sources":[{"source":"osv","source_id":"GHSA-f24x-rm6g-3w5v","url":"https://osv.dev/vulnerability/GHSA-f24x-rm6g-3w5v"}],"summary":"Directus tokens are not redacted in flow logs, exposing session credentials to all admin"}