directus-security

directus-security Audit any Directus instance for the misconfigurations that actually leak data — public-role read exposure, user enumeration, unauthenticated version/schema leaks, GraphQL introspection, and the search-param field-enumeration oracle — and prove each one live with an anonymous...

Directus < 11.9.0 - Version Disclosure

Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus...

Directus - Unauthenticated File Modification

Directus versions from 10.8.0 before 11.9.3 allow unauthenticated attackers to modify the contents of an existing file when a valid file UUID is known. The PATCH /files/id endpoint processes multipart file uploads without proper authentication, allowing file content replacement despite returning ...

directus-preso

The reveal.js files for my presentation about my Directus bug...

CVE-2026-126539

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then...

CVE-2026-126539

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then...

CVE-2026-126539 Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then...

EUVD-2026-123065

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then...

CVE-2026-126539 Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then...

CVE-2026-126539

Directus versions before 12.1.0 are vulnerable to an authorization bypass flaw on public-mode WebSocket connections. The root cause is that sending a failed authentication message with an invalid token causes handleAuthRequest to set accountability to null , allowing unauthenticated attackers to ...

PT-2026-144919

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then...

CVE-2026-126539: directus: Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip…

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then...

@blinkk/root-cms (>=3.5.2, <=4.3.5), @depup/directus (>=12.3.0-depup.0, <=12.5.0-depup.0) +112 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @blinkk/root-cms =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2, =2.208.0, =2.208.0, =2.389.1,...

@blinkk/root-cms (>=3.5.2, <=4.3.5), @depup/directus (>=12.3.0-depup.0, <=12.5.0-depup.0) +112 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @blinkk/root-cms =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2, =2.208.0, =2.208.0, =2.389.1,...

@blinkk/root-cms (>=3.5.2, <=4.3.5), @depup/directus (>=12.3.0-depup.0, <=12.5.0-depup.0) +112 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @blinkk/root-cms =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2, =2.208.0, =2.208.0, =2.389.1,...

Malicious code in directus-codestyle (npm)

Source: ossf-package-analysis a40b79e42e3f1936af95ffd63d1c7652667a9f770625849aa7698f2bfcfca8e1 The OpenSSF Package Analysis project identified 'directus-codestyle' @ 1.3.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

@depup/directus (12.3.0-depup.0), directus (12.3.0) potentially affected by unknown CVE via @directus/api (39.0.0)

@directus/api NPM version 39.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - @depup/directus 12.3.0-depup.0 - directus 12.3.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0109...

WS-2026-0110

Directus 10.11.0 before 12.3.1: public registration sends the verification email to the submitted address instead of the matched account's stored address, so on MySQL/MariaDB with accent-insensitive collation an attacker can receive a verification link for another user's account. GHSA-8xp8-xrh2-8...

@depup/directus (12.3.0-depup.0), directus (12.3.0) potentially affected by unknown CVE via @directus/api (39.0.0)

@directus/api NPM version 39.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - @depup/directus 12.3.0-depup.0 - directus 12.3.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0110...

WS-2026-0109

Directus 9.4.0 before 12.3.1: SharesService update does not block changes to usercreated or re-check share access, so a user who can update a share can reassign its creator and role and gain access to data through the share. GHSA-7h45-q5jx-7r87...