CVE-2024-54151: Directus Unauthenticated Access to WebSocket Events and Operations
Summary
CVE-2024-54151: Directus allows unauthenticated access to WebSocket events and operations. Affects directus versions >= 11.0.0, < 11.3.0. Fixed in 11.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS that provides a powerful API for managing content. It allows users to create, manage, and deliver content across various platforms. The platform supports real-time updates through WebSocket connections, enabling efficient data synchronization. However, a recent vulnerability has been identified that allows unauthenticated users to access sensitive operations and data, potentially compromising the security of Directus instances.
Vulnerability Detail
The vulnerability arises when the configuration options WEBSOCKETS_GRAPHQL_AUTH or WEBSOCKETS_REST_AUTH are set to 'public'. This configuration allows unauthenticated users to perform any CRUD operations and subscribe to WebSocket events with full admin privileges. The accountability for these requests defaults to system/admin level access instead of public permissions, leading to unauthorized access to sensitive data. This issue affects any Directus instance configured with these public access settings, allowing malicious actors to exploit the system without authentication.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.3.0
This is the first release that contains the fix.
npm install directus@11.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid setting WEBSOCKETS_GRAPHQL_AUTH and WEBSOCKETS_REST_AUTH to 'public'. Instead, configure these settings to require authentication. For example, set them as follows:
WEBSOCKETS_GRAPHQL_AUTH=authenticated
WEBSOCKETS_REST_AUTH=authenticated
Conclusion
The vulnerability CVE-2024-54151 in Directus allows unauthenticated access to WebSocket events and operations, posing a significant security risk. It is crucial for users to update their Directus installations to the patched versions and implement proper authentication settings to safeguard their data. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for directus →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
Unauthenticated users can perform CRUD operations and subscribe to WebSocket events, gaining access to sensitive data and operations as if they were administrators.
Yes, you can temporarily secure your instance by changing the WEBSOCKETS_GRAPHQL_AUTH and WEBSOCKETS_REST_AUTH settings to require authentication instead of allowing public access.
The vulnerability affects Directus versions from 11.0.0 to 11.2.x and @directus/api versions from 22.2.0 to 23.1.x. Ensure you update to the fixed versions to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
