CVE-2024-54151

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
directus	directus	>= 11.0.0, < 11.3.0

References

https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21Patch
https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4Exploit, Vendor Advisory
https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4Exploit, Vendor Advisory

Timeline

Published: Dec 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-541529.3Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can wr CVE-2024-541536.5In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter CVE-2024-541549.8In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox CVE-2024-541555.3In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication CVE-2024-541566.5In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack CVE-2024-541576.5In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector CVE-2024-541585.3In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding CVE-2024-541594.1stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.CVE-2024-54165.4The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url CVE-2024-541606.4dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sani CVE-2024-541696.5IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL CVE-2024-54175.4The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/pos