https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 08:20:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-206615 EUVD-2026-206615 https://cve.radiocsirt.org/vuln/euvd-2026-206615 https://cve.radiocsirt.org/vuln/fkie_cve-2024-54151 <p>Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to &#34;public&#34;, an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.</p> <p>Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to &#34;public&#34;, an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-54151 https://cve.radiocsirt.org/vuln/ghsa-849r-qrwj-8rv4 <p><strong>Affected:</strong> npm: directus, npm: @directus/api</p> <p>### Summary When setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to &#34;public&#34;, an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges.</p> <p>### Details Accountability for unauthenticated WebSocket requests is set to null, which used to be &#34;public permissions&#34; until the Permissions Policy update which now defaults that to system/admin level access. So instead of null we need to make use of `createDefaultAccountability()` to ensure public permissions are used for unauthenticated users.</p> <p>### PoC 1. Start directus with ```bash WEBSOCKETS_ENABLED=true WEBSOCKETS_GRAPHQL_AUTH=public WEBSOCKETS_REST_AUTH=public ```</p> <p>2. Subscribe using GQL or REST or do any CRUD operation on a user created collection (system tables are not reachable with crud) ```gql subscription { directus_users_mutated { key event data { id email first_name last_name password } } } ``` or ```json { &#34;type&#34;: &#34;items&#34;, &#34;action&#34;: &#34;read&#34;, &#34;collection&#34;: &#34;your_collection_name&#34; } ``` 3a. Open up the data studio as any user. Observe how the subscriber gets notified on each page navigation (because the users `last_page` gets updated, the `password` fields is properly redacted here)</p> <p>3b. Observe receiving all available items from the `your_collection_name` collection.</p> <p>### Impact</p> <p>This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQ…</p> <p><strong>Affected:</strong> npm: directus, npm: @directus/api</p> <p>### Summary When setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to &#34;public&#34;, an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges.</p> <p>### Details Accountability for unauthenticated WebSocket requests is set to null, which used to be &#34;public permissions&#34; until the Permissions Policy update which now defaults that to system/admin level access. So instead of null we need to make use of `createDefaultAccountability()` to ensure public permissions are used for unauthenticated users.</p> <p>### PoC 1. Start directus with ```bash WEBSOCKETS_ENABLED=true WEBSOCKETS_GRAPHQL_AUTH=public WEBSOCKETS_REST_AUTH=public ```</p> <p>2. Subscribe using GQL or REST or do any CRUD operation on a user created collection (system tables are not reachable with crud) ```gql subscription { directus_users_mutated { key event data { id email first_name last_name password } } } ``` or ```json { &#34;type&#34;: &#34;items&#34;, &#34;action&#34;: &#34;read&#34;, &#34;collection&#34;: &#34;your_collection_name&#34; } ``` 3a. Open up the data studio as any user. Observe how the subscriber gets notified on each page navigation (because the users `last_page` gets updated, the `password` fields is properly redacted here)</p> <p>3b. Observe receiving all available items from the `your_collection_name` collection.</p> <p>### Impact</p> <p>This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQ…</p> https://cve.radiocsirt.org/vuln/ghsa-849r-qrwj-8rv4