Directus versions prior to 11.13.0 improperly handle permissions when fields are deleted. Specifically, field-level permissions are not removed from the permissions table upon field deletion. If a new field with the same name is later created, it inherits the old permissions, potentially granting unauthorized access to data. This issue can lead to unintended privilege escalation in environments where field names are reused.