CVE-2022-26969: Insecure default value for CORS configuration in directus
Summary
CVE-2022-26969: Insecure default value for CORS configuration. Affects directus versions < 9.7.0. Fixed in 9.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS (Content Management System) that provides a user-friendly interface for managing content and data. It allows developers to create custom database schemas and APIs to power their applications. The CORS (Cross-Origin Resource Sharing) configuration in Directus determines which external domains are allowed to access its resources. By default, Directus had a very permissive CORS configuration, which could lead to unauthorized access in uncontrolled environments.
Vulnerability Detail
The default value for the CORS_ENABLED and CORS_ORIGIN configuration in Directus was set to be very permissive, allowing any external domain to access its resources. This could potentially lead to unauthorized access and data leakage in uncontrolled environments where the configuration hasn't been changed. An attacker could exploit this vulnerability to bypass access controls and retrieve sensitive information from the Directus CMS. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.7.0
This is the first release that contains the fix.
npm install directus@9.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Directus is not immediately feasible, a temporary workaround is to manually configure the CORS environment variables to restrict access to trusted domains only. This can be done by setting the CORS_ENABLED variable to 'true' and specifying the allowed domains in the CORS_ORIGIN variable. For example, CORS_ORIGIN='https://example.com' would only allow requests from the example.com domain.
Conclusion
In summary, the default CORS configuration in Directus was insecure, allowing unauthorized access to its resources. It is crucial to update Directus to version 9.7.0 or later and review the CORS configuration to ensure proper access controls. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for directus →
FAQ
Directus is an open-source headless CMS that provides a user-friendly interface for managing content and data.
CORS (Cross-Origin Resource Sharing) is a mechanism that allows resources (e.g., fonts, JavaScript, etc.) on a web page to be requested from another domain outside the domain from which the resource originated.
The impact of this vulnerability is unauthorized access to Directus resources, potentially leading to data leakage and unauthorized modification of content.
To fix this vulnerability, update Directus to version 9.7.0 or later and review and adjust the CORS configuration to match your project's specific usage and requirements.
Yes, if updating Directus is not immediately feasible, you can manually configure the CORS environment variables to restrict access to trusted domains only.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
