SB2026110360 - Multiple vulnerabilities in Directus
Published: November 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to recover sensitive field values hidden by read permissions in Directus collections.
The vulnerability exists due to incorrect authorization in ItemsService.getKeysByQuery when resolving target items for update-by-query and delete-by-query requests without the caller's accountability. A remote user can submit repeated requests with filters on hidden fields in a collection where they have update or delete permission and observe which items appear in the responses to recover those fields' values through a boolean oracle.
Each probe performs a real update or delete on matching items within the user's existing permissions.
2) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass IP-based policy restrictions and gain administrative access from outside the permitted network.
The vulnerability exists due to incorrect authorization in Directus GraphQL WebSocket connection handling when resolving policy access without the client's IP address. A remote user can connect to the GraphQL WebSocket endpoint using an account with an IP-restricted admin_access policy to obtain administrative access because a missing IP address is treated as imposing no restriction.
Affected deployments must use GraphQL WebSockets and rely on ip_access to restrict when a policy's admin_access or app_access applies.
3) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to retain unauthorized elevated access across REST and GraphQL HTTP requests outside the network permitted by an IP-restricted policy.
The vulnerability exists due to incorrect authorization in the Directus global access cache when cached access decisions are reused without accounting for the client's IP address. A remote user can obtain an elevated access result through the GraphQL WebSocket policy bypass and make subsequent REST or GraphQL HTTP requests as the same user to reuse the cached privileges outside the permitted network.
The cached bypass persists until the access-cache entry expires.
4) Insufficient Logging (CVE-ID: N/A)
CWE-ID: CWE-778 - Insufficient Logging
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform actions without recording the client's IP address, user agent, or origin in activity records, reducing their traceability.
The vulnerability exists due to insufficient logging in Directus activity recording when GraphQL WebSocket connections are accepted without forwarding client context into connection accountability. A remote user can perform actions over a GraphQL WebSocket connection to generate activity records that omit the client's IP address, user agent, and origin.
Remediation
Install update from vendor's website.