Vulnerability details
CVE-2026-126539
directus directus
Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
CVSS 4.0
9.2Critical
Official description
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.2Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| directus | directus | v < 12.1.0 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/directus/directus/security/advisories/GHSA-97xr-jchp-xm3c vendor-advisory
- https://github.com/directus/directus/commit/8d4cd86783bcbf5444eaf290e8dcecb33929300e patch
- https://github.com/directus/directus/releases/tag/v12.1.0 release-notes
- https://github.com/directus/directus/blob/v12.0.2/api/src/websocket/controllers/base.ts#L381-L397 technical-description
- https://www.vulncheck.com/advisories/directus-before-12.1.0-authorization-bypass-via-public-websocket-rest-interface third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-11
- Last updated
- 2026-11-11
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 14 · Low
Exploit prediction (EPSS)
No EPSS score has been published for this CVE yet.
Weaknesses (CWE)
- CWE-636Not Failing Securely ('Failing Open')