[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-26185":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":26,"references":30,"score":37,"epss_score":38,"epss_percentile":39,"is_kev":40,"cisa_kev_date_added":41,"cisa_kev_due_date":41,"cisa_ssvc":42,"attack_mappings":52,"exploits":59},16094,"CVE-2026-26185","EUVD-2026-6166","Directus Vulnerable to User Enumeration via Password Reset Timing Attack\n\n### Summary\n\nA timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration.\n\n### Details\n\nThe password reset endpoint implements a timing protection mechanism to prevent user enumeration; however, URL validation executes before the timing protection is applied. This allows an attacker to distinguish between valid and invalid user accounts based on response timing differences.\n\n### Impact\n\nThis vulnerability violates user privacy and may facilitate targeted phishing attacks by allowing attackers to confirm the existence of user accounts.","2026-02-12T22:13:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":17,"privilegesRequired":17,"confidentialityImpact":18},"UNCHANGED","3.1",5.3,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","NONE","LOW",true,[21],"CWE-203",[23,24,25],"cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*","cpe:2.3:a:directus:api:*:*:*:*:*:*:*:*","cpe:2.3:a:directus:directus:*:*:*:*:*:*:*:*",[27,28,29],"Monospace Directus","Directus Directus","Directus Api",[31,32,33,34,35,36],"https:\u002F\u002Fgithub.com\u002Fdirectus\u002Fdirectus\u002Fcommit\u002Fe69aa7a5248c6e3e822cb1ac354dee295df90b2a","https:\u002F\u002Fgithub.com\u002Fdirectus\u002Fdirectus\u002Fpull\u002F26485","https:\u002F\u002Fgithub.com\u002Fdirectus\u002Fdirectus\u002Freleases\u002Ftag\u002Fv11.14.1","https:\u002F\u002Fgithub.com\u002Fdirectus\u002Fdirectus\u002Fsecurity\u002Fadvisories\u002FGHSA-jr94-gj3h-c8rf","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26185","https:\u002F\u002Fgithub.com\u002Fdirectus\u002Fdirectus",0.47,0.00393,0.33251,false,null,{"timestamp":43,"automatable":44,"tech_impact":45,"exploitation":46,"cisa_decision":47,"cisa_remediation_timeline":51},"2026-02-13T15:58:57.512055Z","yes","partial","none",{"vector":48,"decision":49,"priority":50},"CISAv1\u002FE:N\u002FA:Y\u002FT:P\u002FM:H\u002F2026-10-25T19:05:08.299384\u002F","attend","medium","14D",[53],{"name":54,"source":55,"tactics":56,"technique_id":58},"Exploit Public-Facing Application","attack_vector",[57],"initial-access","T1190",[]]