WS-2026-0109

Directus 9.4.0 before 12.3.1: SharesService update does not block changes to usercreated or re-check share access, so a user who can update a share can reassign its creator and role and gain access to data through the share. GHSA-7h45-q5jx-7r87...