Directus 10.13.0 - Insecure object reference via PATH presets

published 2024-08-15 2 y ago modified 2026-06-17 4 mo ago also GHSA-3fff-gqw3-vj86 , EUVD-2024-2631

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.

Patch / fix

fixed in 1

npm directus 10.13.2

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-08-15)

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
GitHub	3.1	4.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	directus	<10.13.2	10.13.2

Affected products

Directus Directus
monospace directus

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key

References

fluidattacks.com /advisories/capaldi
third-party-advisory, web
directus.io /
product
github.com /directus/directus/security/advisories/GHSA-3fff-gqw3-vj86
web
nvd.nist.gov /vuln/detail/CVE-2024-6534
advisory
directus.io
web
github.com /directus/directus
package

Sources

CVE List CVE-2024-6534
GitHub Advisory GHSA-3fff-gqw3-vj86
NVD CVE-2024-6534

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary