Insufficient Logging in Directus - #VU158878
Published: November 3, 2026
Vulnerability identifier: #VU158878
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-778
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform actions without recording the client's IP address, user agent, or origin in activity records, reducing their traceability.
The vulnerability exists due to insufficient logging in Directus activity recording when GraphQL WebSocket connections are accepted without forwarding client context into connection accountability. A remote user can perform actions over a GraphQL WebSocket connection to generate activity records that omit the client's IP address, user agent, and origin.
Affected software
Directus
Remediation
Install security update from vendor's website.
Directus - update to 12.4.0