UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126539

Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

Severity
Critical 9.2
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
12.1.0
Sources
CVE Program

Affected software

SoftwareAffected versions
DirectusServers and applications · cna:directus|directus
  • Every version before 12.1.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126539