5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26185

CVE-2026-26185: Directus Affected by User Enumeration via Password Reset Timing Attack

Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26185

CVE-2026-26185:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
directus	npm	< 11.14.1	11.14.1
@directus/api	npm	< 32.2.0	32.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security advisory describes a timing-based user enumeration vulnerability in the password reset functionality of Directus. The provided commit e69aa7a5248c6e3e822cb1ac354dee295df90b2a directly addresses this issue. The patch modifies the api/src/services/users.ts file, specifically within the UsersService.requestPasswordReset function. The change involves reordering the operations: the validation of the reset_url parameter is moved to before the database query that searches for the user. In the vulnerable version, the user lookup was performed first. This meant that a request with an invalid URL would have a different response time depending on whether the user existed (slower, due to database query) or not (faster). This timing discrepancy could be exploited to confirm the existence of user accounts. The identified vulnerable function, UsersService.requestPasswordReset, is the entry point for this flawed logic and would be the function appearing in a runtime profile during exploitation of this timing attack.

Vulnerable functions

UsersService.requestPasswordReset

api/src/services/users.ts

The vulnerability is in the `requestPasswordReset` function. Before the patch, the function first queries the database to find the user by email (`this.getUserByEmail(email)`) and only then validates the provided `reset_url`. If an attacker provides an invalid `reset_url`, the time it takes for the server to respond will differ depending on whether the email exists in the database or not. This timing difference allows an attacker to enumerate valid user accounts. The patch fixes this by moving the URL validation check before the user database lookup, ensuring that requests with invalid URLs have a consistent response time, regardless of user existence.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.