Secret disclosure via serialized failed-Flow context

Information disclosure in Directus 9.12.0 and later before 11.5.0 allows remote attackers to read secrets through webhook Flow errors. When a webhook-triggered Flow returns Data of Last Operation, a failed-condition ValidationError serializes operation context into the API response, including environment variables, authorization headers, accountability data, and prior operation data. Exploitation requires a reachable Flow with that response mode and a condition that attacker-controlled input can make fail; the disclosed context can expose API keys and user or operational data.