CVE-2023-38503CWE-200

Directus has Incorrect Permission Checking for GraphQL Subscriptions

Medium · published July 25, 2023

CVSS v3.1
5.7
EPSS
0%
Percentile
41.9
In the wild
Unconfirmed
What it is

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters (i.e. `user_created IS $CURRENT_USER`) are not properly checked when using GraphQL subscription resulting in unauthorized users getting event on their subscription which they should not be receiving according to the permissions. This can be any collection but out-of-the box the `directus_users` collection is configured with such a permissions filter allowing you to get updates for other users when changes happen. Version 10.5.0 contains a patch. As a workaround, disable GraphQL subscriptions.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-07-25T22:06Z
EPSS history
Timeline
  • 25 JUL 22:06Z
    Directus has Incorrect Permission Checking for GraphQL Subscriptions
    cvelistv5