AIKIDO-2026-843606
directus is vulnerable to Missing Authorization
53
Medium Risk
This Affects:
directusTL;DR
The project owner endpoint derives its authorization from the settings singleton write it performs, but two side effects run before that check. An outbound owner report assembled from unvalidated request fields is dispatched to the configured compliance endpoint, and if that report fails a direct database write flips directus_settings.project_status to pending. Because accountability is populated globally and unauthenticated requests are not rejected at the middleware layer, a caller receives a permission error while both side effects have already been dispatched. The fix evaluates authorization before performing these side effects.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and PROJECT_OWNER_ENABLED is enabled (the default).
Background info
directus is vulnerable to Missing Authorization in versions 11.13.0 - 12.0.2.
How to fix this
Upgrade the directus library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant