Directus: Authorization bypass via public WebSocket REST interface

Summary

Directus before 12.1.0 contains an authorization bypass in the WebSocket REST interface when public WebSocket authentication mode is enabled. An unauthenticated attacker can send an invalid token, which causes the server to drop the permission context, and then read, create, update or delete records in any user-defined collection. The attack requires that public WebSocket REST access is configured and reachable over the network.

Affected

• Directus versions before 12.1.0 (affected range: 0 to below 12.1.0)
• Relevant only when WEBSOCKETS_REST_AUTH is set to public

Fixed in

• Fixed in Directus 12.1.0 (corresponds to @directus/api 37.0.0)
• Later releases are available; the latest version is 12.5.1 according to the changelog. Review breaking changes before upgrading.

Workaround

• Set WEBSOCKETS_REST_AUTH to handshake or strict
• Alternatively, disable the WebSocket endpoints if they are not needed
• Configured query limits and MAX_BATCH_MUTATION are not authorization controls and must not be relied on as mitigation

Exploitation

• No known exploitation in the wild; no CISA KEV listing found
• No public exploit found; the issue has not been independently reproduced
• Unknown: whether the CVE mapping is confirmed by NVD; the CVSS 9.2 score is unverified

Our recommendation

• Identify all Directus instances and their versions, and check whether WEBSOCKETS_REST_AUTH is set to public
• If public mode is set on an internet-facing instance, apply the workaround immediately or disable WebSockets
• Upgrade to 12.1.0 or later after checking CORS_ORIGIN settings, since WebSocket connections from unlisted origins are now rejected
• Review logs for unexpected WebSocket traffic
• Verify the NVD record and CVSS score once published

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  fixedbyreboot/CVE-2026-126539-POC

Research sources

• GitHub Security Advisory GHSA-97xr-jchp-xm3c github.com
• VulnCheck Advisory www.vulncheck.com
• Directus Release v12.1.0 github.com
• Fix commit 8d4cd86 github.com
• Directus Version 12 Breaking Changes directus.com
• Directus Changelog directus.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:21.