CVE-2026-61836: Directus Cache Key Vulnerability Leading to Unauthorized Data Access
Summary
CVE-2026-61836: Directus: Authorization-dependent response served from unsegmented cache key. Affects directus versions < 12.0.0. Fixed in 12.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source data platform that provides a headless CMS and API for managing database content. It allows users to create, manage, and distribute data through a user-friendly interface. The platform is designed for flexibility and scalability, making it suitable for various applications. However, it has a vulnerability related to its caching mechanism that can lead to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises when response caching is enabled in Directus. The cache key derivation process does not include critical authorization context beyond the user, such as roles and policies. This oversight allows different share tokens or anonymous requests to collide in the cache, leading to unauthorized access to data. For instance, if Share A populates the cache with a filtered response, Share B or an anonymous user can retrieve that same response without proper authorization. This flaw can expose sensitive information and violate confidentiality, particularly when multiple shares or anonymous requests access the same URL and query.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.0.0
This is the first release that contains the fix.
npm install directus@12.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, disable caching by setting CACHE_ENABLED to false in your configuration. This will prevent the caching mechanism from being exploited until you can update to the patched version.
Conclusion
The CVE-2026-61836 vulnerability in Directus poses a significant risk by allowing unauthorized access to cached data. It is crucial to update to version 12.0.0 or later to resolve this issue. Until then, disabling caching is recommended to protect sensitive information.
See every vulnerability recorded for directus →
FAQ
CVE-2026-61836 is a vulnerability in Directus that allows unauthorized access to cached data due to improper cache key derivation.
If your application uses Directus with caching enabled, it may expose sensitive data to unauthorized users or anonymous requests.
If an immediate update is not possible, disable caching by setting CACHE_ENABLED to false to mitigate the risk.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
