Skip to content

fix(api): check permissions on manual Flow triggers (GHSA-7cvf-pxgp-42fc) - #424

Merged
louisdussarps merged 8 commits into
mainfrom
fix/flows-manual-trigger-permissions
Oct 16, 2026
Merged

fix(api): check permissions on manual Flow triggers (GHSA-7cvf-pxgp-42fc)#424
louisdussarps merged 8 commits into
mainfrom
fix/flows-manual-trigger-permissions

Conversation

@louisdussarps

@louisdussarps louisdussarps commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Change description

Manual Flow triggers (POST /flows/trigger/:id) ran without any permission check. Non-admins now need:

  • read access to the Flow (directus_flows)
  • read access to every key in keys, or, when no keys are sent (only allowed with requireSelection: false), read
    access to the collection

keys values that aren't arrays are rejected.

Type of change

  • Bug fix (fixes an issue)
  • New feature (adds functionality)

Related issues

Fix GHSA-7cvf-pxgp-42fc / CVE-2025-53889 (Dependabot #659)

Checklists

Development

  • Lint rules pass locally
  • Application changes have been tested thoroughly
  • Automated tests covering modified code pass

Security

  • Security impact of change has been considered
  • Code follows company security practices and guidelines

Network

  • Changes to network configurations have been reviewed
  • Any newly exposed public endpoints or data have gone through security review

Code review

  • Pull request has a descriptive title and context useful to a reviewer. Screenshots or screencasts are attached as
    necessary
  • reviewers assigned
  • Pull request linked to task tracker where applicable

@louisdussarps @claude
fix(api): check permissions on manual Flow triggers (GHSA-7cvf-pxgp-42fc
3879050 
)

Manual triggers now require read access to the Flow and to the target collection/items.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@louisdussarps louisdussarps self-assigned this Oct 15, 2026
@louisdussarps louisdussarps added security p2 Medium Priority labels Oct 15, 2026
sofiachakir
sofiachakir requested changes Oct 15, 2026
View reviewed changes

@sofiachakir sofiachakir left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we add tests also ?

Comment thread api/src/flows.ts
Comment thread api/src/flows.ts Outdated
Comment thread api/src/flows.ts
louisdussarps and others added 2 commits October 15, 2026 14:17
@louisdussarps @sofiachakir
Update api/src/flows.ts
d4d5e3e 
Co-authored-by: sofiachakir <62932536+sofiachakir@users.noreply.github.com>
@louisdussarps
Revert "Update api/src/flows.ts"
fe7a81c 
This reverts commit d4d5e3e.
@louisdussarps
louisdussarps merged commit 2c9fefc into main Oct 16, 2026
6 checks passed
@github-actions github-actions Bot mentioned this pull request Oct 16, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sofiachakir sofiachakir sofiachakir approved these changes
@ldechamps ldechamps Awaiting requested review from ldechamps

Assignees

@louisdussarps louisdussarps

Labels

p2 Medium Priority security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@louisdussarps @sofiachakir