What is the CVSS score of CVE-2026-61836?

CVE-2026-61836 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Directus are affected by CVE-2026-61836?

Directus before 12.0.0 contains a cache disclosure vulnerability affecting permission controls when response caching is enabled; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-61836?

Within 24 hours: inventory Directus deployments and confirm which have response caching enabled to determine exposure scope. Within 7 days: upgrade all affected instances to Directus 12.0.0, prioritizing production systems. Within 30 days: validate upgrade completion, review recent access logs for suspicious patterns, and audit which user roles and share tokens accessed sensitive endpoints.

Directus CVE-2026-61836

EUVD-2026-44673 HIGH

Use of Cache Containing Sensitive Information (CWE-524)

2026-07-15 GitHub_M

GHSA-c6w9-5g5j-jh2p

Information Disclosure Directus

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Unauthenticated and network-reachable (PR:N/AV:N), but AC:H because exploitation depends on a cache entry pre-populated by a differently-scoped principal; scope changes (S:C) as one principal's data leaks to another, with pure confidentiality impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 15:19 vuln.today

Analysis Generated

Jul 15, 2026 - 15:19 vuln.today

CVE Published

Jul 15, 2026 - 14:17 cve.org

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on directus (1 direct, 1 indirect)

Ecosystem-wide dependent count for version 12.0.0.

DescriptionCVE.org

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.

AnalysisAI

Cross-context cache disclosure in Directus before 12.0.0 lets share-token holders and anonymous clients receive permission-filtered responses that were cached for a differently-scoped principal, because the cache key omits authorization context. When response caching is enabled, the key derived in api/src/utils/get-cache-key.ts covers only version, path, query, and accountability.user; since share tokens and anonymous requests both collapse to user null, requests to the same URL and query share a cache bucket and skip permission re-evaluation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is a straightforward, config-dependent information-disclosure issue fixed in 12.0.0.

Technical ContextAI

Directus is a real-time headless CMS that exposes SQL database content through a REST/GraphQL API and admin app, and offers an optional response cache to reduce database load. The root cause is CWE-524 (use of a cache containing sensitive information): the cache-key function keys entries on accountability.user but ignores the broader authorization context (share, role, roles, admin, app, and policies). Directus 'shares' are scoped, tokenized public links to filtered data, and anonymous callers have no user; both resolve accountability.user to null, so two principals with different effective permissions map to the same cache key for an identical path and query. The upstream fix (PR #27707, commit 7ba4efb) namespaces the cache key by adding the share id when present, and adds regression tests proving different shares, anonymous requests, and authenticated users no longer collide on the same URL.

RemediationAI

Vendor-released patch: upgrade to Directus 12.0.0 (https://github.com/directus/directus/releases/tag/v12.0.0), which namespaces cache keys by share and prevents cross-context collisions. If immediate upgrade is not possible, the most effective compensating control is to disable response caching (e.g. CACHE_ENABLED=false), which fully removes the collision at the cost of higher database load and slower repeated queries. As a narrower alternative, avoid using share links and public/anonymous access on cached endpoints, or segregate/purge the cache so share and anonymous traffic cannot reuse entries populated by other principals; this reduces cache hit rates and still does not address collisions between different roles. After patching, flush any existing cache so stale, mis-scoped entries created before the upgrade are not served. See advisory GHSA-c6w9-5g5j-jh2p for authoritative guidance.