CVE-2026-61836

Directus: Authorization-dependent response served from unsegmented cache key

Published Jul 15, 2026 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.

Analysis

Technical impact

The vulnerability arises because Directus omits authorization data from the API cache key, so a response cached for one user or share can be served to a second requester with a different authorization context, including anonymous or other share tokens. This allows an attacker to obtain data they should not be able to see, constituting an unauthorized disclosure of sensitive information. The flaw is represented by CWE‑524 and CWE‑639.

Affected Systems

Any Directus installation running a version earlier than 12.0.0 with response caching enabled is impacted.

Risk and Exploitability

The CVSS score of 8.6 denotes high severity, while the EPSS score of less than 1 % indicates a low current exploitation probability. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote API access; an attacker simply needs network connectivity to the Directus instance and can trigger a cached endpoint, then retrieve the cached response that contains data they cannot normally view. No special privileges or authentication are required to exploit this flaw.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

directus

affected

Version	Status	Constraints
`< 12.0.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Directus

Version	Status	Scheme	Platform
`[0,12.0.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Directus version 12.0.0 or newer, which corrects the cache key generation logic.
If an upgrade cannot be performed immediately, disable response caching in the Directus configuration to eliminate the vulnerability surface.
Review any external or custom caching components used in your deployment and verify that they include authorization context when generating cache keys, or disable caching of authorization‑sensitive responses.

Generated by OpenCVE AI on July 31, 2026 at 03:39 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-c6w9-5g5j-jh2p	Directus: Authorization-dependent response served from unsegmented cache key

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.474% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/directus/directus/commit/7ba4efb97525d3af33570537c76e44baea767f13
https://github.com/directus/directus/pull/27707
https://github.com/directus/directus/releases/tag/v12.0.0
https://github.com/directus/directus/security/advisories/GHSA-c6w9-5g5j-jh2p

History

Jul 15, 2026 10:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Directus Directus directus
Vendors & Products		Directus Directus directus

Jul 15, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 3:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.
Title		Directus: Authorization-dependent response served from unsegmented cache key
Weaknesses		CWE-524 CWE-639
References		https://github.com/directus/directus/commit/7ba4efb97525d3af33570537c76e44baea767f13 https://github.com/directus/directus/pull/27707 https://github.com/directus/directus/releases/tag/v12.0.0 https://github.com/directus/directus/security/advisories/GHSA-c6w9-5g5j-jh2p
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}`