CVE-2026-126539

Name of the Vulnerable Software and Affected Versions Directus versions prior to 12.1.0

Description An authorization bypass exists in the WebSocket REST interface. Unauthenticated attackers can skip permission checks by sending a failed authentication message on public-mode WebSocket connections. By providing an invalid token, the handleAuthRequest() function sets accountability to null, enabling the attacker to read, create, update, or delete records in any user-defined collection.

Recommendations Update to version 12.1.0.