Missing Authorization in Directus - #VU141277
Published: August 7, 2026
Vulnerability identifier: #VU141277
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read, create, update, or delete records in any user-defined collection.
The vulnerability exists due to missing authorization in the WebSocket REST items handler and ItemsService when processing subsequent items messages on a socket after a failed auth message or token expiry clears accountability to null. A remote attacker can send an invalid authentication message and then send crafted items messages to read, create, update, or delete records in any user-defined collection.
Only instances with WebSocket REST access enabled in public authentication mode are affected. Directus system collections are not reachable through this path.
Affected software
Directus
Remediation
Install security update from vendor's website.
Directus - update to 12.1.0