The vulnerability arises because Directus omits authorization data from the API cache key, so a response cached for one user or share can be served to a second requester with a different authorization context, including anonymous or other share tokens. This allows an attacker to obtain data they should not be able to see, constituting an unauthorized disclosure of sensitive information. The flaw is represented by CWE‑524 and CWE‑639.

Any Directus installation running a version earlier than 12.0.0 with response caching enabled is impacted.

The CVSS score of 8.6 denotes high severity, while the EPSS score of less than 1 % indicates a low current exploitation probability. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote API access; an attacker simply needs network connectivity to the Directus instance and can trigger a cached endpoint, then retrieve the cached response that contains data they cannot normally view. No special privileges or authentication are required to exploit this flaw.