{"id":"CVE-2026-126539","kind":"vulnerability","aliases":["CVE-2026-126539"],"related":[],"title":"Directus: WebSocket auth failure lets anonymous users skip permission checks","description":"Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.","summary":"Directus before 12.1.0 lets an unauthenticated client send a failed auth message on a public-mode WebSocket connection, which clears the request's accountability so permission checks are skipped. An attacker can then read, create, update or delete records in any user-defined collection.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directus","package","self-hosted","websocket"],"not_affected_if":["directus-12.1.0-or-later","websockets-disabled"],"how_to_check":"- Check the Directus version in your deployment, for example `directus --version` or the package.json of your Directus project, and see whether it is below `12.1.0`.\n- Check whether WebSocket access is enabled on your Directus instance (the WebSockets setting in the Directus configuration), since the flaw is on public-mode WebSocket connections.","fix":"- Directus: move to `12.1.0` or later.","status":"open","published_at":"2026-11-11T01:17:15+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","triaged_at":"2026-11-11T01:25:45+00:00","updated_at":"2026-11-11T01:25:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T01:25:45Z","model":"claude-haiku-5-5","output":{"fix":"- Directus: move to `12.1.0` or later.","reach":"internet","title":"Directus: WebSocket auth failure lets anonymous users skip permission checks","impact":"high","summary":"Directus before 12.1.0 lets an unauthenticated client send a failed auth message on a public-mode WebSocket connection, which clears the request's accountability so permission checks are skipped. An attacker can then read, create, update or delete records in any user-defined collection.","audience":"businesses","category":"package","nicknames":[],"who_cares":["directus","self-hosted","websocket"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attackers read, change or delete any collection's records","analyst_note":"Confirm WebSocket and public-mode preconditions from the Directus advisory before relying on them.\n","how_to_check":"- Check the Directus version in your deployment, for example `directus --version` or the package.json of your Directus project, and see whether it is below `12.1.0`.\n- Check whether WebSocket access is enabled on your Directus instance (the WebSockets setting in the Directus configuration), since the flaw is on public-mode WebSocket connections.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["directus-12.1.0-or-later","websockets-disabled"],"who_is_affected":"Directus instances older than 12.1.0 that accept WebSocket connections in public mode are exposed, since an unauthenticated client can reach collections the public role should not see. Instances on 12.1.0 or later, or with WebSockets disabled, are not affected by this description. Whether a given instance is reachable from the internet decides how urgent the upgrade is.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000774,"input_tokens":4636,"output_tokens":621,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126539':13A,16A '-2026':12A,15A '12.1.0':25B,71C 'account':47B,106C 'allow':78C 'anonym':6A 'attack':54B,80C,97C 'auth':3A,33B,89C 'author':74C 'bypass':75C 'check':10A,50B,84C 'clear':43B 'client':29B 'collect':68B,121C 'connect':41B,96C 'contain':72C 'creat':58B,111C 'cve':11A,14A 'defin':67B,120C 'delet':61B,114C 'directus':1A,17B,23B,69C 'fail':32B,88C 'failur':4A 'handleauthrequest':104C 'host':21B 'invalid':101C 'let':5A,26B 'messag':34B,90C 'mode':39B,94C 'null':108C 'packag':18B 'permiss':9A,49B,83C 'public':38B,93C 'public-mod':37B,92C 'read':57B,110C 'record':62B,115C 'request':45B 'self':20B 'self-host':19B 'send':30B,86C,99C 'set':105C 'skip':8A,52B,82C 'token':102C 'unauthent':28B,79C 'updat':59B,112C 'user':7A,66B,119C 'user-defin':65B,118C 'vulner':76C 'websocket':2A,22B,40B,95C","nicknames":[],"mitigations":[],"who_affected":"Directus instances older than 12.1.0 that accept WebSocket connections in public mode are exposed, since an unauthenticated client can reach collections the public role should not see. Instances on 12.1.0 or later, or with WebSockets disabled, are not affected by this description. Whether a given instance is reachable from the internet decides how urgent the upgrade is.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","directus","package","selfhosted","websocket"],"campaign_type":null,"search_a":"'-126539':13A,16A '-2026':12A,15A 'anonym':6A 'auth':3A 'check':10A 'cve':11A,14A 'directus':1A 'failur':4A 'let':5A 'permiss':9A 'skip':8A 'user':7A 'websocket':2A","search_b":"'12.1.0':25B 'account':47B 'attack':54B 'auth':33B 'check':50B 'clear':43B 'client':29B 'collect':68B 'connect':41B 'creat':58B 'defin':67B 'delet':61B 'directus':17B,23B 'fail':32B 'host':21B 'let':26B 'messag':34B 'mode':39B 'packag':18B 'permiss':49B 'public':38B 'public-mod':37B 'read':57B 'record':62B 'request':45B 'self':20B 'self-host':19B 'send':30B 'skip':52B 'unauthent':28B 'updat':59B 'user':66B 'user-defin':65B 'websocket':22B,40B","search_c":"'12.1.0':71C 'account':106C 'allow':78C 'attack':80C,97C 'auth':89C 'author':74C 'bypass':75C 'check':84C 'collect':121C 'connect':96C 'contain':72C 'creat':111C 'defin':120C 'delet':114C 'directus':69C 'fail':88C 'handleauthrequest':104C 'invalid':101C 'messag':90C 'mode':94C 'null':108C 'permiss':83C 'public':93C 'public-mod':92C 'read':110C 'record':115C 'send':86C,99C 'set':105C 'skip':82C 'token':102C 'unauthent':79C 'updat':112C 'user':119C 'user-defin':118C 'vulner':76C 'websocket':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-05T14:10:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126539","severity":null,"published_at":"2026-11-11T01:17:15+00:00","modified_at":"2026-11-11T01:17:15+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","fetched_at":"2026-11-11T01:24:34+00:00","note":null}],"documents":[{"id":121287,"url":"https://github.com/directus/directus/commit/8d4cd86783bcbf5444eaf290e8dcecb33929300e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":121288,"url":"https://github.com/directus/directus/releases/tag/v12.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":121289,"url":"https://github.com/directus/directus/security/advisories/GHSA-97xr-jchp-xm3c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-05T14:10:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":121290,"url":"https://www.vulncheck.com/advisories/directus-before-12.1.0-authorization-bypass-via-public-websocket-rest-interface","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}