CVE-2024-54151

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions...

Unauthorized Access

directus is vulnerable to Unauthorized Access. The vulnerability is due to improper authentication handling when WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH is set to "public," allowing unauthenticated users to perform CRUD operations and subscribe to changes with full admin privileges...

PT-2024-36074

Name of the Vulnerable Software and Affected Versions: Directus versions 11.0.0 through 11.2.x Description: Directus is a real-time API and App dashboard for managing SQL database content. When setting WEBSOCKETS GRAPHQL AUTH or WEBSOCKETS REST AUTH to "public", an unauthenticated user is able to...