Authorization Bypass Vulnerability in Directus by Directus, Inc.

CVE-2026-126539

What is CVE-2026-126539?

Directus, a popular open-source data platform, is vulnerable to an authorization bypass issue in versions prior to 12.1.0. This flaw permits unauthenticated attackers to circumvent permission checks through public-mode WebSocket connections. By transmitting an invalid authentication token, attackers can manipulate the application's response, effectively nullifying accountability. This vulnerability enables them to read, create, update, or delete records across any user-defined collection without proper authorization, posing a significant risk to the integrity and confidentiality of user data.

References