SB2026110361 - Incorrect authorization in Directus

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110361

SB2026110361 - Incorrect authorization in Directus

Published: November 3, 2026

Security Bulletin ID SB2026110361
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access information through AI tools intended only for administrators, without gaining permissions beyond those already assigned to the user.

The vulnerability exists due to incorrect authorization in the AI Chat endpoint (POST /ai/chat) when handling requests for admin-only AI tools. A remote user can use an account with app access to request the flows and operations tools and read information permitted by the account's existing policies through an interface reserved for administrators.

Exploitation requires an AI provider to be configured on the instance.


Remediation

Install update from vendor's website.

References