In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMonospace Directus
APPMonospace< 9.7.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
References
Related vulnerabilities
CVE-2025-55746CRITICAL9.3PL ✓same product
Directus: nieautoryzowana modyfikacja i upload plików z dowolną zawartością
CVE-2026-61836HIGH8.6PL ✓same product
Directus: błąd klucza cache umożliwia nieautoryzowany dostęp do danych
CVE-2026-61835HIGH7.7PL ✓same product
SSRF w Directus — bypass ochrony przez adres 0.0.0.0
CVE-2026-39942HIGH8.5same product
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /...
CVE-2026-35412HIGH7.1same product
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus' T...