Vulnerabilities

Security fix · GHSA-p623-wgx3-wxp8

Directus applies side effects in service overrides before permission checks, allowing unauthorized data modification

Published Aug 5, 2026 · catalog updated Aug 5, 2026 · Directus applies side effects

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-p623-wgx3-wxp8. A missing EPSS score is not a low risk. Compare Directus applies side effects with the linked advisory before you change production.

Severity

Medium6.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm directus

## Description ### Summary Several Directus service classes override the base mutation methods to perform cleanup work (nullifying foreign keys, clearing caches) before delegating to the superclass. The caller's or permission check runs inside the superclass method, so those side effects were applied before authorization was evaluated. When the superclass subsequently rejected the request with , the side effects had already been committed. The most impactful instance is ( ), which nullified and on every row in belonging to the target flow. Because Directus does not require a token to reach a service (the middleware assigns accountability but does not reject anonymous requests), and the flows controller adds no pre-service authorization layer, an unauthenticated caller issuing received while the operation graph of that flow was permanently disconnected. The flow row and its operation rows survive, so the Admin App still lists the flow as active, but execution halts after the first step and the original link targets are not recoverable without manual reconstruction by an administrator. Two sibling services shared the same ordering defect and are covered by the same patch: - ( ) nullified , , and for the target user before authorization, allowing an unauthorized caller to strip authorship metadata from rows belonging to a user they cannot delete. - and ( ) invoked the global permissions cache flush before authorization. The target primary key does not need to correspond to an existing row, so any path-valid UUID triggered a full invalidation of the / / cache (process-local, and Redis-shared where configured), forcing all subsequent requests to re-derive permissions from the database. The same patch also reordered non-externally-reachable side effects in and , and stopped the user-invite controller from surfacing a rejected invite as an error. ### Impact - **Availability of automation.** An unauthorized or unauthenticated caller who knows a flow's UUID can permanently b