CVE-2026-61836 (CVSS 8.6)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0.

Is your site exposed to CVE-2026-61836?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS — Exploit Prediction

0.0027

Probability of exploitation

0.19%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-524 CWE-524

CWE-639 CWE-639

References

Other References

https://github.com/directus/directus/commit/7ba4efb97525d3af33570537c76e44baea767f13 https://github.com/directus/directus/pull/27707 https://github.com/directus/directus/releases/tag/v12.0.0 https://github.com/directus/directus/security/advisories/GHSA-c6w9-5g5j-jh2p

Frequently Asked Questions

What is CVE-2026-61836? +

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user null, so different shares or anonymous clients requesting the same URL and query can receive a permission-filtered cached response without permission re-evaluation. This issue is fixed in version 12.0.0. It has a CVSS v3.1 base score of 8.6 (HIGH).

How severe is CVE-2026-61836? +

CVE-2026-61836 has a CVSS v3.1 score of 8.6 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0027, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-61836? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-82755

Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth …

CVE-2025-4233

An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control …

CVE-2026-89186

Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and …

CVE-2026-92442

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cached for …

CVE-2026-108088

** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on …

CVE-2026-92443

The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying …

CVE-2026-61836