Executive brief
Directus is an open-source data platform used to manage and serve content. A security flaw in its caching system allows unauthorized users or different share-link holders to view sensitive data they should not have access to. If caching is enabled, the system may serve a previously saved response intended for one specific user to anyone else requesting the same link, potentially exposing private information or bypassing password protections on shared content.
Technical details
A cache key collision vulnerability exists in Directus when CACHE_ENABLED is set to true. The cache-key derivation logic in `api/src/utils/get-cache-key.ts` fails to include sufficient authorization context, such as share tokens or roles, in the generated key. Specifically, share-authentication tokens do not assign a user ID, causing both share-based and anonymous requests to resolve to a null user value in the cache key. Consequently, if a share-token holder populates the cache for a specific URL, an anonymous user or a different share-token holder requesting the same URL will receive the cached, permission-filtered response without further authorization checks. This allows for cross-share confidentiality breaches and bypasses password protection on shares. The issue is fixed in version 12.0.0.
Affected products
- Directus directus < 12.0.0
Timeline
- 2026-06-24: disclosed: Original disclosure date
- 2026-07-15: advisory: NVD publication date
- 2026-07-20: patched: GitHub Advisory reviewed and updated with patch information