AIKIDO-2026-390592

TL;DR

When a Directus instance is configured for public WebSocket REST access, a failed authentication message on an already connected socket replaces the client's public accountability with a null accountability and leaves the connection open. Null accountability is the internal-trust state for which the service layer skips permission evaluation entirely, so every subsequent item message runs with no authorization check. An unauthenticated caller can deliberately submit an invalid token, or let a token expire, and then read, create, update, or delete records in any user-defined collection, including mass deletion by filter. The fix retains a public-role accountability object on authentication failure and token expiry in every WebSocket mode.