TI-2023-19883 Aliases CVE-2023-38503 GHSA-gggm-66rh-pp98

Directus has Incorrect Permission Checking for GraphQL Subscriptions

LOW 29CWE-200Published 2023-07-25 · Updated 2024-10-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-863.

Summary

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters (i.e. `user_created IS $CURRENT_USER`) are not properly checked when using GraphQL subscription resulting in unauthorized users getting event on their subscription which they should not be receiving according to the permissions. This can be any collection but out-of-the box the `directus_users` collection is configured with such a permissions filter allowing you to get updates for other users when changes happen. Version 10.5.0 contains a patch. As a workaround, disable GraphQL subscriptions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00499 43rd percentileScored 2026-11-07

Fix Fixed directus (directus): 10.5.0directus (npm): 10.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
directus	directus	10.3.0 to before 10.5.0	10.5.0	Patch available	CNA
—	directus (npm)	10.3.0 to before 10.5.0	10.5.0	Patch available	GHSA-gggm-66rh-pp98

directus Vendordirectus Affected 10.3.0 to before 10.5.0 Fixed in 10.5.0 Patch available CNA
directus (npm) Vendor— Affected 10.3.0 to before 10.5.0 Fixed in 10.5.0 Patch available GHSA-gggm-66rh-pp98

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:monospace:directus::::::node.js::*	10.3.0 to before 10.5.0	Vulnerable	directus

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:* Versions 10.3.0 to before 10.5.0 Vulnerable ·directus

Remediation

Fix · CNA directus (directus) Fixed in 10.5.0
Fix · GHSA-gggm-66rh-pp98 directus (npm) Fixed in 10.5.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-38503
2026-10-03 Alias added: GHSA-gggm-66rh-pp98

References

Patch 1

https://github.com/directus/directus/pull/19155

Advisory 2

Other 1

https://github.com/directus/directus

TI-2025-21659 Directus's webhook trigger flows can leak sensitive data CVSS 3.1HIGH 8.6
TI-2024-36266 Directus allows unauthenticated access to WebSocket events and operations CVSS 3.1HIGH 7.5
TI-2024-26791 Directus allows SSO User Enumeration CVSS 3.1HIGH 7.5
TI-2024-23956 Directus is soft-locked by providing a string value to random string util CVSS 3.1HIGH 7.5
TI-2024-26624 Directus Incorrectly handles _in` filter CVSS 3.1HIGH 7.7
TI-2025-21658 Directus `search` query parameter allows enumeration of non permitted fields CVSS 3.1MEDIUM 5.3

See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences