CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +16 more potentially affected by CVE-2026-61836 via directus (>=9.6.0, <=12.0.0-rc.2)

directus NPM version =9.6.0, =1.6.3, =11.16.1-depup.0, =15.0.0, =1.2.2, =0.1.0, =1.0.0, =1.0.1, =1.0.12 and more Source cves: CVE-2026-61836 Source advisory: MEND:CVE-2026-61836...