AIKIDO-2026-843606
directus is vulnerable to Missing Authorization
53
CVE Score
Medium
Missing Authorization
TL;DR
The project owner endpoint derives its authorization from the settings singleton write it performs, but two side effects run before that check. An outbound owner report assembled from unvalidated request fields is dispatched to the configured compliance endpoint, and if that report fails a direct database write flips directus_settings.project_status to pending. Because accountability is populated globally and unauthenticated requests are not rejected at the middleware layer, a caller receives a permission error while both side effects have already been dispatched. The fix evaluates authorization before performing these side effects.
How do I fix this?
Upgrade the directus library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and PROJECT_OWNER_ENABLED is enabled (the default).
Package
Versions
11.13.0 - 12.0.2
Fixed in 12.1.0Background info
directus is vulnerable to Missing Authorization in versions 11.13.0 - 12.0.2.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.