CVE-2026-61836

HighCVSS 8.6/10Last modified Jul 28, 2026

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-524 CWE-639

Affected software

Vendor	Product	Versions
directus	directus	< 12.0.0

References

https://github.com/directus/directus/commit/7ba4efb97525d3af33570537c76e44baea767f13Patch
https://github.com/directus/directus/pull/27707Issue Tracking, Patch
https://github.com/directus/directus/releases/tag/v12.0.0Release Notes
https://github.com/directus/directus/security/advisories/GHSA-c6w9-5g5j-jh2pVendor Advisory

Timeline

Published: Jul 15, 2026
Last modified: Jul 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-618375.3RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes f CVE-2026-618388.2Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy CVE-2026-61842.4A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/we CVE-2026-618402.3Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public CVE-2026-618426.5Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configur CVE-2026-618438.2FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-ena CVE-2026-618447.1FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens l CVE-2026-618458.9Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific CVE-2026-618466.3Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS s CVE-2026-618476.3Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` o CVE-2026-618486.3Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input contain CVE-2026-618509.3Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the