CVE-2024-54151

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue.

• CWE-200

• https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21Patch
• https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4Exploit, Vendor Advisory
• https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4Exploit, Vendor Advisory

Published

Dec 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-54146Cacti is an open source performance and fault management fra…8.8
• CVE-2024-54147Altair is a GraphQL client for all platforms. Prior to versi…6.8
• CVE-2024-54148Gogs is an open source self-hosted Git service. A malicious …9.8
• CVE-2024-54149Winter is a free, open-source content management system (CMS…8.4
• CVE-2024-5415A vulnerability have been discovered in PhpMyBackupPro affec…7.1
• CVE-2024-54150cjwt is a C JSON Web Token (JWT) Implementation. Algorithm c…9.1
• CVE-2024-54152Angular Expressions provides expressions for the Angular.JS …9.3
• CVE-2024-54153In JetBrains YouTrack before 2024.3.51866 unauthenticated da…6.5
• CVE-2024-54154In JetBrains YouTrack before 2024.3.51866 system takeover wa…9.8
• CVE-2024-54155In JetBrains YouTrack before 2024.3.51866 improper access co…5.3
• CVE-2024-54156In JetBrains YouTrack before 2024.3.52635 multiple merge fun…6.5
• CVE-2024-54157In JetBrains YouTrack before 2024.3.52635 potential ReDoS wa…6.5