Is CVE-2026-61836 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61836 being exploited in the wild.

How severe is CVE-2026-61836?

High severity, with a CVSS score of 8.6, published 15 July 2026.

Which products and versions are affected?

directus (npm) < 12.0.0, SEMVER:introduced=0,fixed=12.0.0.

Is there a fix for CVE-2026-61836?

Yes. directus (npm): upgrade to 12.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61836 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-61836?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61836: Directus authorization bypass via unsegmented response cache key

Q: Which products and versions are affected?

directus (npm) < 12.0.0, SEMVER:introduced=0,fixed=12.0.0.

Q: Is there a fix for CVE-2026-61836?

Yes. directus (npm): upgrade to 12.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61836 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-61836?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61836 · Severity: high · CVSS 8.6 · Published 2026-07-15

Directus is an open-source data platform used to manage and serve content. A security flaw in its caching system allows unauthorized users or different share-link holders to view sensitive data they should not have access to. If caching is enabled, the system may serve a previously saved response intended for one specific user to anyone else requesting the same link, potentially exposing private information or bypassing password protections on shared content.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2026-61836 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61836 being exploited in the wild.
How severe is CVE-2026-61836?: High severity, with a CVSS score of 8.6, published 15 July 2026.
Which products and versions are affected?: directus (npm) < 12.0.0, SEMVER:introduced=0,fixed=12.0.0.
Is there a fix for CVE-2026-61836?: Yes. directus (npm): upgrade to 12.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61836 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-61836?: Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 12.0.0 or later
```
npm install directus@12.0.0
```

Technical details

A cache key collision vulnerability exists in Directus when CACHE_ENABLED is set to true. The cache-key derivation logic in `api/src/utils/get-cache-key.ts` fails to include sufficient authorization context, such as share tokens or roles, in the generated key. Specifically, share-authentication tokens do not assign a user ID, causing both share-based and anonymous requests to resolve to a null user value in the cache key. Consequently, if a share-token holder populates the cache for a specific URL, an anonymous user or a different share-token holder requesting the same URL will receive the cached, permission-filtered response without further authorization checks. This allows for cross-share confidentiality breaches and bypasses password protection on shares. The issue is fixed in version 12.0.0.

Affected products

Directus directus < 12.0.0

Identifiers

CVE-2026-61836
GHSA-c6w9-5g5j-jh2p

Timeline

2026-06-24: disclosed: Original disclosure date
2026-07-15: advisory: NVD publication date
2026-07-20: patched: GitHub Advisory reviewed and updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.