# Directus vulnerabilities

Source: https://junglewise.ai/threats/vendors/directus  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 11 November 2026, 02:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/directus.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 36 vulnerabilities in Directus: 1 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126539, was published on 11 November 2026. Nothing was published in the last eight weeks.

## Counts

- Last 7 days: 1
- Last 30 days: 1
- Last 90 days: 1
- All time: 36 (0 critical, 0 exploited in the wild)

## About Directus

Directus is a headless CMS and API platform for managing content and databases.

## Latest Directus vulnerabilities

- [CVE-2026-126539: Directus authorization bypass in WebSocket public mode](https://junglewise.ai/threats/cve-2026-126539-directus-before-12-1-0-contains-an-authorization-bypass) (high, CVSS 8.1, published 11 Nov 2026)
- [CVE-2026-61836: Directus authorization bypass via unsegmented response cache key](https://junglewise.ai/threats/cve-2026-61836-directus-authorization-bypass-via-unsegmented-response-cache-key) (high, CVSS 8.6, published 15 Jul 2026)
- [CVE-2026-61835: Directus SSRF bypass in file import via 0.0.0.0 address](https://junglewise.ai/threats/cve-2026-61835-directus-ssrf-bypass-in-file-import-via-0-0-0-0-address) (high, CVSS 7.7, published 15 Jul 2026)
- [CVE-2026-35410: Directus open redirect in login redirection logic](https://junglewise.ai/threats/cve-2026-35410-directus-open-redirect-in-login-redirection-logic) (medium, CVSS 6.1, published 6 Apr 2026)
- [CVE-2026-35408: Directus account takeover via missing COOP header in SSO login](https://junglewise.ai/threats/cve-2026-35408-directus-account-takeover-via-missing-coop-header-in-sso-login) (high, CVSS 8.7, published 6 Apr 2026)
- [Directus unauthenticated denial of service via GraphQL alias amplification](https://junglewise.ai/threats/directus-unauthenticated-denial-of-service-via-graphql-alias-a0cc9ef0) (low, CVSS 3.1, published 4 Apr 2026)
- [CVE-2026-39942: Directus broken access control in file management API](https://junglewise.ai/threats/cve-2026-39942-directus-path-traversal-and-broken-access-control-in-file) (low, CVSS 3.1, published 4 Apr 2026)
- [CVE-2026-22032: Directus open redirect in SAML authentication](https://junglewise.ai/threats/cve-2026-22032-directus-open-redirect-in-saml-authentication-callback) (low, CVSS 3.1, published 6 Jan 2026)
- [CVE-2025-53889: Directus missing permission checks for manual trigger Flows](https://junglewise.ai/threats/cve-2025-53889-directus-missing-permission-checks-for-manual-trigger-flows) (low, CVSS 3.1, published 15 Jul 2025)
- [CVE-2025-53886: Directus Flows WebHook trigger token exposure in logs](https://junglewise.ai/threats/cve-2025-53886-directus-flows-webhook-trigger-token-exposure-in-logs) (low, CVSS 3.1, published 15 Jul 2025)
- [CVE-2025-30353: Directus webhook trigger flows sensitive data leak](https://junglewise.ai/threats/cve-2025-30353-directus-webhook-trigger-flows-sensitive-data-leak) (low, CVSS 3.1, published 26 Mar 2025)
- [CVE-2025-30352: Directus search query parameter information disclosure](https://junglewise.ai/threats/cve-2025-30352-directus-search-query-parameter-information-disclosure) (low, CVSS 3.1, published 26 Mar 2025)
- [CVE-2025-30351: Directus suspended user session token bypass](https://junglewise.ai/threats/cve-2025-30351-directus-suspended-user-session-token-bypass) (low, CVSS 3.1, published 26 Mar 2025)
- [CVE-2025-30350: Directus S3 storage socket exhaustion with HEAD requests](https://junglewise.ai/threats/cve-2025-30350-directus-s3-storage-socket-exhaustion-with-head-requests) (low, CVSS 3.1, published 26 Mar 2025)
- [CVE-2025-27089: Directus authorization bypass in overlapping update policies](https://junglewise.ai/threats/cve-2025-27089-directus-authorization-bypass-in-overlapping-update-policies) (low, CVSS 3.1, published 19 Feb 2025)
- [CVE-2024-6533: Directus DOM-based XSS in layout_options](https://junglewise.ai/threats/cve-2024-6533-directus-dom-based-xss-in-layout-options) (low, CVSS 3.4, published 23 Jan 2025)
- [CVE-2024-54151: Directus unauthenticated WebSocket access to CRUD operations](https://junglewise.ai/threats/cve-2024-54151-directus-unauthenticated-websocket-access-to-crud-operations) (low, CVSS 3.1, published 9 Dec 2024)
- [CVE-2024-6534: Directus IDOR in presets allows reassignment to other users](https://junglewise.ai/threats/cve-2024-6534-directus-idor-in-presets-allows-reassignment-to-other-users) (low, CVSS 3.1, published 27 Aug 2024)
- [CVE-2024-39895: Directus GraphQL field duplication denial of service](https://junglewise.ai/threats/cve-2024-39895-directus-graphql-field-duplication-denial-of-service) (low, CVSS 3.1, published 8 Jul 2024)
- [CVE-2024-39701: Directus incorrect handling of _in filter](https://junglewise.ai/threats/cve-2024-39701-directus-incorrect-handling-of-in-filter) (low, CVSS 3.1, published 8 Jul 2024)
- [CVE-2024-39699: Directus blind SSRF via file import redirect bypass](https://junglewise.ai/threats/cve-2024-39699-directus-blind-ssrf-via-file-import-redirect-bypass) (low, CVSS 3.1, published 8 Jul 2024)
- [CVE-2024-36128: Directus denial of service in random string utility](https://junglewise.ai/threats/cve-2024-36128-directus-denial-of-service-in-random-string-utility) (low, CVSS 3.1, published 4 Jun 2024)
- [CVE-2024-34709: Directus session token invalidation bypass](https://junglewise.ai/threats/cve-2024-34709-directus-session-token-invalidation-bypass) (low, CVSS 3.1, published 13 May 2024)
- [CVE-2024-28239: Directus open redirect in OAuth2/OpenID login](https://junglewise.ai/threats/cve-2024-28239-directus-open-redirect-in-oauth2-openid-login) (low, CVSS 3.1, published 12 Mar 2024)
- [CVE-2024-28238: Directus session token exposure in URL on files page](https://junglewise.ai/threats/cve-2024-28238-directus-session-token-exposure-in-url-on-files-page) (low, CVSS 3.1, published 12 Mar 2024)

## Most severe Directus vulnerabilities

- [CVE-2026-35408: Directus account takeover via missing COOP header in SSO login](https://junglewise.ai/threats/cve-2026-35408-directus-account-takeover-via-missing-coop-header-in-sso-login) (high, CVSS 8.7, published 6 Apr 2026)
- [CVE-2026-61836: Directus authorization bypass via unsegmented response cache key](https://junglewise.ai/threats/cve-2026-61836-directus-authorization-bypass-via-unsegmented-response-cache-key) (high, CVSS 8.6, published 15 Jul 2026)
- [CVE-2026-126539: Directus authorization bypass in WebSocket public mode](https://junglewise.ai/threats/cve-2026-126539-directus-before-12-1-0-contains-an-authorization-bypass) (high, CVSS 8.1, published 11 Nov 2026)
- [CVE-2026-61835: Directus SSRF bypass in file import via 0.0.0.0 address](https://junglewise.ai/threats/cve-2026-61835-directus-ssrf-bypass-in-file-import-via-0-0-0-0-address) (high, CVSS 7.7, published 15 Jul 2026)
- [CVE-2026-35410: Directus open redirect in login redirection logic](https://junglewise.ai/threats/cve-2026-35410-directus-open-redirect-in-login-redirection-logic) (medium, CVSS 6.1, published 6 Apr 2026)
- [CVE-2024-6533: Directus DOM-based XSS in layout_options](https://junglewise.ai/threats/cve-2024-6533-directus-dom-based-xss-in-layout-options) (low, CVSS 3.4, published 23 Jan 2025)
- [CVE-2023-26492: Directus server-side request forgery on file import](https://junglewise.ai/threats/cve-2023-26492-directus-server-side-request-forgery-on-file-import) (low, CVSS 3.1, published 3 Mar 2023)
- [CVE-2022-36031: Directus unhandled exception on illegal filename_disk value](https://junglewise.ai/threats/cve-2022-36031-directus-unhandled-exception-on-illegal-filename-disk-value) (low, CVSS 3.1, published 30 Aug 2022)
- [CVE-2022-26969: Directus insecure default CORS configuration](https://junglewise.ai/threats/cve-2022-26969-directus-insecure-default-cors-configuration) (low, CVSS 3.1, published 5 Apr 2022)
- [CVE-2022-23080: Directus server-side request forgery in media upload](https://junglewise.ai/threats/cve-2022-23080-directus-server-side-request-forgery-in-media-upload) (low, CVSS 3.1, published 23 Jun 2022)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 1 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Directus vulnerabilities", https://junglewise.ai/threats/vendors/directus, 11 November 2026.