Directus Cache Key Missing Authorization Context Leads to IDOR (CVE-2025-6439)

Vulnerability Overview Vulnerability Name: Authorization-dependent response served from unsegmented cache key Vulnerability Description: When response caching is enabled ( ), the cache key derivation in includes only the version, path, query, and (plus conditional ). Authorization aspects beyond the user (user, role, roles, admin, app, policies) are not included. For shared tokens, this payload is borne. Directus's shared authentication flow ( ) issues a JWT that does not contain ; therefore, never assigns , resulting in becoming the default value in the cache key input. Each shared token and each anonymous request will use as the cache key input. Two distinct shared (or anonymous request) requests targeting the same URL will generate the same cache key. The first request will populate the cache with the response filtered by permissions; subsequent requests from unrelated users or anonymous clients will receive the uncached response without re-evaluation. This is a web caching pattern issue: "Authorization-dependent response cached under unsegmented cache key" (cache key collision / missing authorization context in cache key). CVE ID: CVE-2025-6439 CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: None Scope: Changed Confidentiality: High Integrity: None Availability: None CVSS v3 Score: 8.6 / 10 Scope of Impact Configuration Requirements: (any storage: memory, redis, memcached) plus at least one active row. Default Settings: This is not the default behavior; defaults to . Since caching is documented as part of role permission settings, operators are not affected. Affected Versions: Affected Versions: < 12.0.0 Fixed Version: 12.0.0 Remediation Fixed Version: Upgrade to version 12.0.0 or higher. Vulnerability Class CWE-524: Use of Cache containing Sensitive Information CWE-639: Authorization Bypass Through User-Controlled Key (here, the key is the derived cache key, not the URL) OWASP API2023: Broken Object Property Level Authorization Impact Cross-Share Confidentiality Leakage: Any shared filtered response can be served to holders of different shared tokens or to anonymous requests that hit the same URL and query. Shares are promoted as a mechanism to distribute restricted, read-only access to specific projects; this flaw makes the shared data for each shared query readable by any other shared token holder or any anonymous client that can reach the URL. Anonymous Requests Can Read Shared Data: Anonymous requests also compute . An anonymous client hitting the same URL and query (e.g., ) after the shared request has populated the cache will receive its shared-scoped payload without any authentication. Derived Effects of Password-Protected Shares: Password protection exists only in (JWT issuance). Once any share populates the cache for a URL, anonymous or alternative share requests to that URL will retrieve the cached payload without exchanging the share password. This is the same cache key collision symptom as password-protected shares, with no obvious distinction. Persistence: The leakage persists for the window (typically 5 to 30 minutes). clears cache collections on mutation writes but does not purge by user or share. Using (common in production), leaked cache entries survive restarts. No Write Impact: The bypass is read-only. Additional Information Reporter: brice-jo Publication Date: 3 weeks ago GitHub Link: GitHub Link

Goal Reached Thanks to every supporter — we hit 100%!

Directus Cache Key Missing Authorization Context Leads to IDOR (CVE-2025-6439)

More from this source