CVE-2021-26593

CVE-2021-26593 describes an information disclosure vulnerability in Directus 8.x through 8.8.1, allowing unauthenticated attackers to enumerate all user accounts via the /users/{id} API endpoint. This flaw exposes sensitive user data, including email addresses, names, and potentially 2FA secrets, though these secrets can be regenerated. Rated High severity (CVSS 7.5), the vulnerability has a low attack complexity and no user interaction required, leading to a high confidentiality impact. Despite its severity, there is no evidence of active exploitation, no public exploit code available, and minimal community discussion, likely due to the affected products being end-of-life.