CVE-2024-54151

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21	Patch
https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4	Exploit Vendor Advisory
https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*

History

18 Nov 2025, 21:39

Type	Values Removed	Values Added
References	~~() https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21 -~~	() https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21 - Patch
References	~~() https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4 -~~	() https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4 - Exploit, Vendor Advisory
First Time		Monospace Monospace directus
CPE		cpe:2.3:a:monospace:directus::::::node.js::*
CWE		NVD-CWE-noinfo

Information

Published : 2024-12-09 21:15

Updated : 2025-11-18 21:39

NVD link : CVE-2024-54151

Mitre link : CVE-2024-54151

CVE.ORG link : CVE-2024-54151

JSON object : View

Products Affected

monospace

directus

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2024-54151", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-12-09T21:15:08.753", "references": [{"url": "https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to \"public\", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue."}, {"lang": "es", "value": "Directus es una API en tiempo real y un panel de control de aplicaciones para administrar el contenido de bases de datos SQL. A partir de la versi\u00f3n 11.0.0 y anteriores a la versi\u00f3n 11.3.0, al configurar `WEBSOCKETS_GRAPHQL_AUTH` o `WEBSOCKETS_REST_AUTH` como \"p\u00fablico\", un usuario no autenticado puede realizar cualquiera de las operaciones admitidas (CRUD, suscripciones) con privilegios de administrador completos. Esto afecta a cualquier instancia de Directus que tenga `WEBSOCKETS_GRAPHQL_AUTH` o `WEBSOCKETS_REST_AUTH` configurado como `p\u00fablico`, lo que permite que los usuarios no autenticados se suscriban a los cambios en cualquier colecci\u00f3n o realicen operaciones REST CRUD en colecciones definidas por el usuario ignorando los permisos. La versi\u00f3n 11.3.0 soluciona el problema."}], "lastModified": "2025-11-18T21:39:33.677", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E09262DD-9786-4C46-909B-F6FFF07AAB46", "versionEndExcluding": "11.3.0", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}