CVE-2026-126539 · Package
NO FIX YET · SEE WHAT TO DO
Directus before 12.1.0 lets an unauthenticated client send a failed auth message on a public-mode WebSocket connection, which clears the request's accountability so permission checks are skipped. An attacker can then read, create, update or delete records in any user-defined collection.
first public Aug 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Directus instances older than 12.1.0 that accept WebSocket connections in public mode are exposed, since an unauthenticated client can reach collections the public role should not see. Instances on 12.1.0 or later, or with WebSockets disabled, are not affected by this description. Whether a given instance is reachable from the internet decides how urgent the upgrade is.
Not affected if directus-12.1.0-or-later, websockets-disabled
Who cares directus, self-hosted, websocket
directus --version or the package.json of your Directus project, and see whether it is below 12.1.0.12.1.0 or later.Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.