CVE-2026-61836
Directus: Authorization-dependent response served from unsegmented cache key
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.
| CWE | CWE-524 CWE-639 |
| Vendor | directus |
| Product | directus |
| Published | Jul 15, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for directus directus
Be the first to know when new high vulnerabilities affecting directus directus are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
directus / directus
< 12.0.0
References
github.com: https://github.com/directus/directus/security/advisories/GHSA-c6w9-5g5j-jh2p github.com: https://github.com/directus/directus/pull/27707 github.com: https://github.com/directus/directus/commit/7ba4efb97525d3af33570537c76e44baea767f13 github.com: https://github.com/directus/directus/releases/tag/v12.0.0