CVE-2026-61836 directus CVE debrief

Who should care

Users of Directus API versions prior to 12.0.0 should apply the patch to prevent unauthorized access to cached responses. Affected operators, platforms, vulnerability-management teams, and security teams should prioritize patching and review compensating controls for exposed systems.

Technical summary

The Directus API prior to version 12.0.0 has a cache-key derivation flaw. When response caching is enabled, the cache key is derived from version, path, query, and accountability.user, but it omits authorization context such as share, role, roles, admin, app, and policies. This omission allows different shares or anonymous clients requesting the same URL and query to receive a permission-filtered cached response without permission re-evaluation. The issue is fixed in version 12.0.0, which includes the necessary authorization context in cache-key derivation.

Defensive priority

High priority should be given to applying the patch in version 12.0.0 to prevent unauthorized access to cached responses.

Recommended defensive actions

• Apply the patch by upgrading to Directus API version 12.0.0 or later
• Review and update cache configuration to ensure proper authorization context is included
• Monitor for any suspicious activity related to cached responses
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-15T15:16:48.603Z and was last modified on 2026-07-28T15:46:30.503Z. The NVD entry is currently Analyzed. Evidence limits suggest that affected deployments may exist in managed environments. Defenders should verify and confirm whether Directus API versions prior to 12.0.0 are in use and apply patches accordingly.

Official resources