Incorrect behavior order in Directus - #VU141288
Published: August 7, 2026
Vulnerability identifier: #VU141288
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-696
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to incorrect behavior order in FlowsService.deleteMany when handling a DELETE request for a flow. A remote attacker can send a specially crafted request referencing a known flow UUID to cause a denial of service.
Webhook-trigger flow UUIDs may be exposed in public trigger URLs, and affected flows can appear active while downstream steps no longer run.
Affected software
Directus
Remediation
Install security update from vendor's website.
Directus - update to 12.1.0