https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T01:56:55.500798+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-228968 EUVD-2026-228968 2026-10-08T01:56:55.587363+00:00 EUVD-2026-228968 https://cve.radiocsirt.org/vuln/fkie_cve-2022-26969 fkie_cve-2022-26969 2026-10-08T01:56:55.587403+00:00

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

 https://cve.radiocsirt.org/vuln/ghsa-g27j-74fp-xfpr GHSA-g27j-74fp-xfpr — Insecure default value for CORS configuration 2026-10-08T01:56:55.587435+00:00

Affected: npm: directus

### Impact

The default value for the `CORS_ENABLED` and `CORS_ORIGIN` configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.

### Patches

The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0

### Workarounds

Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.

### For more information If you have any questions or comments about this advisory: * Open an issue in [directus/directus](https://github.com/directus/directus) * Email us at [security@directus.io](mailto:security@directus.io)

 https://cve.radiocsirt.org/vuln/gsd-2022-26969 gsd-2022-26969 2026-10-08T01:56:55.587470+00:00 gsd-2022-26969