# CVE-2026-61836: Directus authorization bypass via unsegmented response cache key

Source: https://junglewise.ai/threats/cve-2026-61836-directus-authorization-bypass-via-unsegmented-response-cache-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-61836 · Severity: high · CVSS 8.6 · Published 2026-07-15

Directus is an open-source data platform used to manage and serve content. A security flaw in its caching system allows unauthorized users or different share-link holders to view sensitive data they should not have access to. If caching is enabled, the system may serve a previously saved response intended for one specific user to anyone else requesting the same link, potentially exposing private information or bypassing password protections on shared content.

Technologies: [directus (npm)](https://junglewise.ai/threats/technologies/directus). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-61836 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61836 being exploited in the wild.

**How severe is CVE-2026-61836?** High severity, with a CVSS score of 8.6, published 15 July 2026.

**Which products and versions are affected?** directus (npm) < 12.0.0, SEMVER:introduced=0,fixed=12.0.0.

**Is there a fix for CVE-2026-61836?** Yes. directus (npm): upgrade to 12.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61836 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61836?** Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- directus (npm): upgrade to 12.0.0 or later

  ```sh
  npm install directus@12.0.0
  ```


## Technical details

A cache key collision vulnerability exists in Directus when CACHE_ENABLED is set to true. The cache-key derivation logic in `api/src/utils/get-cache-key.ts` fails to include sufficient authorization context, such as share tokens or roles, in the generated key. Specifically, share-authentication tokens do not assign a user ID, causing both share-based and anonymous requests to resolve to a null user value in the cache key. Consequently, if a share-token holder populates the cache for a specific URL, an anonymous user or a different share-token holder requesting the same URL will receive the cached, permission-filtered response without further authorization checks. This allows for cross-share confidentiality breaches and bypasses password protection on shares. The issue is fixed in version 12.0.0.

## Affected products

- Directus directus < 12.0.0

## Identifiers

- CVE-2026-61836
- GHSA-c6w9-5g5j-jh2p

## Timeline

- 2026-06-24: disclosed: Original disclosure date
- 2026-07-15: advisory: NVD publication date
- 2026-07-20: patched: GitHub Advisory reviewed and updated with patch information

## References

- [https://api.github.com/users/tr4ce-ju](https://api.github.com/users/tr4ce-ju)
- [https://github.com/tr4ce-ju](https://github.com/tr4ce-ju)
- [https://api.github.com/users/tr4ce-ju/gists%7B/gist_id%7D](https://api.github.com/users/tr4ce-ju/gists%7B/gist_id%7D)
- [https://api.github.com/users/tr4ce-ju/repos](https://api.github.com/users/tr4ce-ju/repos)
- [https://avatars.githubusercontent.com/u/118045916?v=4](https://avatars.githubusercontent.com/u/118045916?v=4)
- [https://api.github.com/users/tr4ce-ju/events%7B/privacy%7D](https://api.github.com/users/tr4ce-ju/events%7B/privacy%7D)

## Related threats

- [Directus SSRF bypass in file import via 0.0.0.0 address](https://junglewise.ai/threats/cve-2026-61835-directus-ssrf-bypass-in-file-import-via-0-0-0-0-address)
- [Directus sensitive information disclosure via aggregate queries](https://junglewise.ai/threats/cve-2026-35442-directus-sensitive-information-disclosure-via-aggregate-queries)
- [Directus resource exhaustion via GraphQL alias amplification](https://junglewise.ai/threats/cve-2026-35441-directus-resource-exhaustion-via-graphql-alias-amplification)
- [Directus GraphQL introspection bypass in system endpoint](https://junglewise.ai/threats/cve-2026-35413-directus-graphql-introspection-bypass-in-system-endpoint)
- [Directus authorization bypass in TUS resumable upload endpoint](https://junglewise.ai/threats/cve-2026-35412-directus-authorization-bypass-in-tus-resumable-upload-endpoint)