Pain point · Permissions & security · Causes churn
User auth fields can be set through create endpoints
1 source thread · first seen 2026-09
Summary
The createOne and createMany paths do not apply the restrictions enforced on updates for sensitive user fields. This lets callers set a TFA secret during account creation and allows non-admins with user-create permission to set protected provider fields.
- Affects
- Directus administrators and users with create access to directus_users
Evidence
Excerpts are copied word for word from the source; follow the link to read it in full.
“`createOne` and `createMany` aren't guarded which means that a `tfa_secret` written through the create path bypasses verification”