Incorrect authorization in Directus - #VU158876
Published: November 3, 2026
Vulnerability identifier: #VU158876
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass IP-based policy restrictions and gain administrative access from outside the permitted network.
The vulnerability exists due to incorrect authorization in Directus GraphQL WebSocket connection handling when resolving policy access without the client's IP address. A remote user can connect to the GraphQL WebSocket endpoint using an account with an IP-restricted admin_access policy to obtain administrative access because a missing IP address is treated as imposing no restriction.
Affected deployments must use GraphQL WebSockets and rely on ip_access to restrict when a policy's admin_access or app_access applies.
Affected software
Directus
Remediation
Install security update from vendor's website.
Directus - update to 12.4.0