Directus versions prior to 11.13.0 and 32.0.0 contain a vulnerability where authenticated users with read permissions can search concealed sensitive fields such as tokens, TFA secrets, and password hashes. Although the actual values are masked in search results, the presence of matching records confirms the existence of specific sensitive data. This enables enumeration attacks that can verify valid authentication tokens and identify accounts with compromised passwords by cross-referencing known password hashes. The vulnerability arises from default permissions granting broad read access, increasing exposure risk.