CVE-2026-126539 Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
CriticalCVSS 9.2
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm directus | < 12.1.0 | 12.1.0 |
References
- GitHub Security Advisory (GHSA-97xr-jchp-xm3c) vendor-advisory
- github.com patch
- Directus v12.1.0 Release Notes release-notes
- github.com technical-description
- VulnCheck Advisory: Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface third-party-advisory