GHSA-97xr-jchp-xm3c: Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

Published Nov 11, 2026

Updated

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Directus to a version that resolves this vulnerability.
Fixed in 12.1.0

Event History

Nov 11, 2026

CVE Published

via OSV·12:58 AM

Data Sourced

via OSV·12:58 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Directus versions before 12.1.0 are affected where public-mode WebSocket connections are available. The issue applies to user-defined collections.

Does an attacker need an account or valid credentials?

No. An unauthenticated attacker can trigger the bypass by sending a failed authentication message with an invalid token over a public-mode WebSocket connection.

What access can an attacker gain through the bypass?

An attacker can bypass permission checks and read, create, update, or delete records in any user-defined collection.

How can I tell whether an exploit attempt may have occurred?

Review WebSocket activity for public-mode connections that send invalid authentication tokens, and investigate subsequent record reads or modifications affecting user-defined collections.

GHSA-97xr-jchp-xm3c: Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need an account or valid credentials?

What access can an attacker gain through the bypass?

How can I tell whether an exploit attempt may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need an account or valid credentials?

What access can an attacker gain through the bypass?

How can I tell whether an exploit attempt may have occurred?