UpHeron
All vulnerabilities

Servers and applications

CVE-2024-54151

Unauthenticated access to WebSocket events and operations

Severity
High 7.5
Published
9 Dec 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.3.0
Also known as
GHSA-849r-qrwj-8rv4
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either…

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • From 11.0.0 before 11.3.0
DirectusServers and applications · github:directus/directus
  • From 11.0.0 before 11.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-54151
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-54151
  • GitHub Advisory Database https://github.com/advisories/GHSA-849r-qrwj-8rv4
  • github.com https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4