Before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
Not on CISA's list of exploited flaws, and not in the news we track.
9.2of 10, critical
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126539. Nothing runs until you send it.
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.