CVE-2026-126539: Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Directusto a version that resolves this vulnerability.Fixed in 12.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Directus deployments running a version before 12.1.0 are affected when they expose public-mode WebSocket connections. The vulnerable interface can be used against user-defined collections.
What does an attacker need to exploit the bypass?
No valid credentials or user interaction are required. An attacker sends a failed authentication message with an invalid token over a public-mode WebSocket connection, causing permission checks to be skipped.
What access can exploitation provide?
An unauthenticated attacker can read, create, update, or delete records in any user-defined collection. This can affect confidentiality, integrity, and availability of application data.
How can the issue be remediated?
Upgrade Directus to version 12.1.0 or later. The provided advisory and release information identify 12.1.0 as the version containing the fix.