CVE-2024-39701 Directus Incorrectly handles _in` filter

Directus is a real-time API and App dashboard for managing SQL database content. Directus =9.23.0, =v10.5.3 improperly handles in, nin operators. It evaluates empty arrays as valid so expressions like "role": "in": $CURRENTUSER.somefield would evaluate to true allowing the request to pass. This...

PT-2024-28640

Name of the Vulnerable Software and Affected Versions Directus versions 9.23.0 through 10.5.3 Description The issue arises from the improper handling of in and nin operators in Directus, where empty arrays are evaluated as valid. This leads to Broken Access Control, as rules intended to pass only...