CVE-2026-61836
CVE-2026-61836 is a high-severity vulnerability in Monospace Directus with a CVSS 3.x base score of 8.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-524.
Key facts
- Severity: High (CVSS 3.x base score 8.6)
- EPSS exploit prediction: 0% (20th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-524
- Affected product: Monospace Directus
- Published:
- Last modified:
Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.
Frequently asked questions
- What is CVE-2026-61836?
- Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.
- How severe is CVE-2026-61836?
- CVE-2026-61836 has a CVSS 3.x base score of 8.6, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2026-61836 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-61836?
- CVE-2026-61836 affects Monospace Directus. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-61836?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-61836 published?
- CVE-2026-61836 was published on 2026-07-15 and last updated on 2026-07-28.
References
- https://github.com/directus/directus/commit/7ba4efb97525d3af33570537c76e44baea767f13
- https://github.com/directus/directus/pull/27707
- https://github.com/directus/directus/releases/tag/v12.0.0
- https://github.com/directus/directus/security/advisories/GHSA-c6w9-5g5j-jh2p
Affected products (1)
- cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*
More vulnerabilities in Monospace Directus
- CVE-2022-26969 — Critical (CVSS 9.8): In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
- CVE-2025-55746 — Critical (CVSS 9.3): Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a…
- CVE-2026-35408 — High (CVSS 8.7): Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single…
- CVE-2025-30353 — High (CVSS 8.6): Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior…
- CVE-2026-39942 — High (CVSS 8.5): Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH…
- CVE-2024-27295 — High (CVSS 8.2): Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the…
All CVEs affecting Monospace Directus →
Other CWE-524 vulnerabilities
- CVE-2026-53943 — Critical (CVSS 9.6): Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that…
- CVE-2025-64762 — Critical (CVSS 9.1): The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS &…
- CVE-2026-71316 — High (CVSS 7.5): Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries…
- CVE-2026-65755 — High (CVSS 7.5): Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere…
- CVE-2026-64792 — High (CVSS 7.5): Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs…
- CVE-2026-50170 — High (CVSS 7.5): Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and…