CVE-2026-61836

Analyzed Analyzed - Analysis Complete

Authentication Bypass via Cache Key in Directus

Publication date: 2026-07-15

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-28

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-61836

EUVD

EUVD-2026-44673

Affected Vendors & Products

Vendor	Product	Version / Range
monospace	directus	to 12.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-524	The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in Directus versions before 12.0.0 involves improper cache key generation when response caching is enabled. The cache key includes version, path, query, and user accountability but omits authorization context like share tokens, roles, or admin status. This causes different users or shares accessing the same URL to receive identical cached responses, bypassing permission checks.

Detection Guidance

Check if Directus is running a version prior to 12.0.0 by running: curl -s https://your-directus-instance.com | grep -i version. If response caching is enabled (CACHE_ENABLED=true in config), inspect cache keys for share tokens or anonymous users by reviewing API responses for identical URLs returning different data for different users.

Impact Analysis

An attacker could exploit this to access sensitive data intended for other users or shares. For example, a share token holder might retrieve cached responses meant for a different share, or an anonymous user could bypass password protection and access restricted content. The impact includes unauthorized data exposure and potential data leaks lasting for the cache TTL duration (typically 5-30 minutes).

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, and failure to maintain proper access controls, potentially leading to regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade Directus to version 12.0.0 or later immediately. If upgrading is not possible, disable response caching by setting CACHE_ENABLED=false in the configuration. Review and remove any active share tokens to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-61836. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70