What is the CVSS score of CVE-2026-61836?

CVE-2026-61836 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

Which versions of Directus are affected by CVE-2026-61836?

Directus before 12.0.0 contains a cache disclosure vulnerability affecting permission controls when response caching is enabled; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-61836?

Within 24 hours: inventory Directus deployments and confirm which have response caching enabled to determine exposure scope. Within 7 days: upgrade all affected instances to Directus 12.0.0, prioritizing production systems. Within 30 days: validate upgrade completion, review recent access logs for suspicious patterns, and audit which user roles and share tokens accessed sensitive endpoints.

Directus CVE-2026-61836

EUVD-2026-44673 HIGH

Use of Cache Containing Sensitive Information (CWE-524)

2026-07-15 GitHub_M

Information Disclosure Directus

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Unauthenticated and network-reachable (PR:N/AV:N), but AC:H because exploitation depends on a cache entry pre-populated by a differently-scoped principal; scope changes (S:C) as one principal's data leaks to another, with pure confidentiality impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 15:19 vuln.today

Analysis Generated

Jul 15, 2026 - 15:19 vuln.today

CVE Published

Jul 15, 2026 - 14:17 cve.org

HIGH 8.6

DescriptionCVE.org

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.

AnalysisAI

Cross-context cache disclosure in Directus before 12.0.0 lets share-token holders and anonymous clients receive permission-filtered responses that were cached for a differently-scoped principal, because the cache key omits authorization context. When response caching is enabled, the key derived in api/src/utils/get-cache-key.ts covers only version, path, query, and accountability.user; since share tokens and anonymous requests both collapse to user null, requests to the same URL and query share a cache bucket and skip permission re-evaluation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify cached Directus endpoint

Delivery

Wait for/trigger privileged cache population

Exploit

Request identical URL as anonymous or other share

Execution

Receive mis-scoped cached response

Impact

Read unauthorized filtered data

Access

Identify cached Directus endpoint

Delivery

Wait for/trigger privileged cache population

Exploit

Request identical URL as anonymous or other share

Execution

Receive mis-scoped cached response

Impact

Read unauthorized filtered data

Vulnerability AssessmentAI

Exploitation	Exploitation requires response caching to be enabled in Directus (not enabled by default), and requires that a cacheable response for the exact same path and query string was already cached by a principal with different effective permissions - specifically a Directus share token or an authenticated user whose accountability.user resolves differently from the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) reflects a network-reachable, unauthenticated confidentiality breach with a scope change, which matches a cache that leaks one principal's authorized data to another. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	On a Directus instance with response caching enabled, a share link (or an authenticated user) first requests a filtered collection endpoint, populating the cache with a permission-filtered response. An anonymous visitor or a holder of a different share token then requests the identical URL and query and is served that cached response without permission re-evaluation, disclosing records they should not see. …
Remediation	Vendor-released patch: upgrade to Directus 12.0.0 (https://github.com/directus/directus/releases/tag/v12.0.0), which namespaces cache keys by share and prevents cross-context collisions. … Detailed patch versions, workarounds, and compensating controls in full report.