CVE-2026-61836

Executive Summary

CVE-2026-61836 is a high-severity information disclosure vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The flaw resides in the cache-key derivation logic within api/src/utils/get-cache-key.ts. When response caching is enabled, the cache key is constructed using version, path, query, and accountability.user, but critically omits the full authorization context, including share, role, roles, admin, app, and policies. This allows different share tokens or anonymous clients requesting the same URL and query to receive a cached response that was originally permission-filtered for a different user, without re-evaluating permissions. An attacker can exploit this to access data they are not authorized to view.

Supply Chain & Package Security

Directus is an open-source Node.js package distributed via npm. The vulnerability affects all versions prior to 12.0.0. Organizations using Directus should verify their version and update immediately. The fix is included in version 12.0.0, which addresses the cache-key derivation to include the full authorization context.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The vulnerability is easily exploitable over the network without authentication, making it a significant threat to data confidentiality.

Deep Dive & Mechanics

The vulnerability originates in the cache-key generation function. When caching is enabled, Directus generates a cache key to store and retrieve API responses. The key is derived from:

• version
• path
• query
• accountability.user

However, the authorization context—specifically share, role, roles, admin, app, and policies—is not included. This means that two different share tokens (or an anonymous user and a share token) that both resolve to user: null will produce the same cache key for identical requests. Consequently, a cached response intended for one user (with specific permission filters) may be served to another user, bypassing permission checks.

For example:

1. User A with a share token requests /items/articles?limit=10. The response is cached with a key based on user: null.
2. User B with a different share token (or anonymous) requests the same URL. The cache key matches, and the cached response (which may include data User B should not see) is returned without re-evaluating permissions.

This is a classic cache poisoning/confusion vulnerability that undermines the access control mechanism.

Vulnerable vs. Patched Code

Vulnerable Code (api/src/utils/get-cache-key.ts):

export function getCacheKey(req: Request): string {
  const { version, path, query, accountability } = req;
  const user = accountability?.user ?? null;
  return `${version}:${path}:${JSON.stringify(query)}:${user}`;
}

Patched Code (api/src/utils/get-cache-key.ts in v12.0.0):

export function getCacheKey(req: Request): string {
  const { version, path, query, accountability } = req;
  const user = accountability?.user ?? null;
  const share = accountability?.share ?? null;
  const role = accountability?.role ?? null;
  const roles = accountability?.roles ?? null;
  const admin = accountability?.admin ?? null;
  const app = accountability?.app ?? null;
  const policies = accountability?.policies ?? null;
  return `${version}:${path}:${JSON.stringify(query)}:${user}:${share}:${role}:${roles}:${admin}:${app}:${JSON.stringify(policies)}`;
}

The patched version includes all authorization context fields in the cache key, ensuring that different authorization contexts produce different cache keys.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Directus instance (version < 12.0.0) with caching enabled.
• Two different share tokens (or one share token and anonymous access) that have different permission scopes.

Exploitation Steps:

1. Identify a Directus endpoint that returns permission-filtered data (e.g., /items/articles).
2. Obtain a share token with access to a specific set of articles (e.g., share_token_A).
3. Send a request with share_token_A to the endpoint:

   curl -H "Authorization: Bearer share_token_A" "https://target.directus.app/items/articles?limit=10"
   

   This response is cached.
4. As an anonymous user (or with a different share token share_token_B that has no access to those articles), send the same request:

   curl "https://target.directus.app/items/articles?limit=10"
   

   If the cache key matches, the attacker receives the cached response containing data they should not see.

Expected Outcome: The attacker gains unauthorized access to data that was permission-filtered for another user.

Blue Team

Detection:

• Monitor for repeated identical API requests from different IPs or tokens that return the same response.
• Look for cache hits on endpoints that should require permission re-evaluation.
• Use the detection rules provided below.

Mitigation:

• Immediately upgrade to Directus version 12.0.0 or later.
• If upgrade is not possible, disable response caching temporarily.
• Implement additional logging for cache hits and permission checks.

Indicators of Compromise (IOCs)

• Network: Repeated identical HTTP requests to the same Directus API endpoint from different source IPs or with different authorization tokens.
• Logs: Cache hit events for endpoints that should have different responses based on user permissions.
• System: Unusual access patterns where anonymous or low-privilege users receive data that should be restricted.

Detection Engineering

YARA Rule

rule CVE_2026_61836_Directus_Cache_Key {
    meta:
        description = "Detects vulnerable cache-key generation in Directus source code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-61836"
    strings:
        $vuln_func = "getCacheKey"
        $vuln_key = "accountability?.user ?? null"
        $missing_ctx = "share" nocase
    condition:
        $vuln_func and $vuln_key and not $missing_ctx
}

Sigma Rule

title: Directus Cache Key Authorization Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2026-61836 by monitoring for cache hits on permission-sensitive endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: directus
detection:
    selection:
        event: "cache_hit"
        endpoint: "/items/*"
    condition: selection
falsepositives:
    - Legitimate cache hits for public data
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-61836 Directus Cache Key Bypass"; flow:to_server; content:"/items/"; http_uri; content:"Authorization"; http_header; nocase; pcre:"/Bearer\s+[A-Za-z0-9\-._~+/]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Directus version 12.0.0 or later.
2. Workaround: Disable response caching in Directus configuration until upgrade is applied.
3. Long-term: Implement a Web Application Firewall (WAF) rule to block requests with mismatched authorization contexts.
4. Monitoring: Enable detailed logging for cache operations and permission checks. Alert on anomalies.

Valters IT