Loading story…
Directus disclosed CVE-2026-61836, a high-severity information disclosure flaw affecting versions prior to 12.0.0 when response caching is enabled. The vulnerability stems from cache keys that included the version, path, query, and accountability.user but failed to incorporate authorization context such as share, role, roles, admin, app, and policies. Because share-token requests and anonymous requests can both resolve to user null, different clients requesting the same URL could receive a cached response generated under another permission context, potentially exposing sensitive data without re-evaluating access controls.
The issue is rated CVSS 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N and is mapped to CWE-524 and CWE-639. A Directus code change addressed the problem by adding the share identifier from req.accountability.share to the cache key namespace, preventing collisions between different share tokens, anonymous requests, and authenticated sessions. The patch also introduced tests confirming that separate share tokens now generate distinct cache keys while repeated anonymous requests and repeated use of the same share token remain consistently cached.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-61836 was published as a high-severity vulnerability affecting Directus versions prior to 12.0.0 when response caching is enabled. The disclosure states that cache-key derivation omitted authorization context, which could cause unauthorized disclosure of sensitive cached data, and notes the issue was fixed in version 12.0.0.
A Directus code change updated API cache key generation to include the share identifier, preventing requests made with different share tokens from colliding with each other, anonymous requests, or authenticated user requests. The commit also added tests validating distinct cache keys for different shares on the same URL.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Directus fixed two high-severity vulnerabilities in versions prior to **11.17.0** that allowed authenticated, low-privilege users to bypass intended protections. One flaw, tracked as `CVE-2026-35442`, let users extract raw values from fields marked as concealed by abusing aggregate functions such as `min` and `max`, especially when combined with `groupBy`. The exposure could reveal sensitive data stored in affected collections, including static API tokens and two-factor authentication secrets from `directus_users`. A second flaw, `CVE-2026-39942`, affected the file management API and allowed path traversal and broken access control through the `PATCH /files/{id}` endpoint. By supplying a user-controlled `filename_disk` value, an authenticated attacker could point writes at another user's storage path, overwrite file contents, and modify metadata such as `uploaded_by` to obscure the tampering. The issues were classified under weaknesses including `CWE-200`, `CWE-863`, `CWE-284`, and `CWE-639`, and both were remediated in **Directus 11.17.0**.
Jun 29, 2026
A high-severity vulnerability tracked as **`CVE-2026-33120`** was disclosed in Microsoft SQL Server, where an untrusted pointer dereference can allow **remote code execution** by an authenticated attacker with low privileges. The flaw is rated **CVSS 8.8** and can be exploited over the network without user interaction, with potential impact across confidentiality, integrity, and availability. Successful exploitation could lead to **system-level compromise** of the database server, enabling database theft, credential dumping, lateral movement, and possible tenant-isolation escape in shared or multi-tenant deployments. A separate disclosure, **`CVE-2026-40155`**, affects the **Auth0 Next.js SDK** and stems from a race condition in the DPoP proxy fetcher that can expose one user’s session identifiers, access tokens, or API response data to another concurrent authenticated user. The issue is rated **CVSS 5.4** and is considered harder to exploit because it depends on precise timing, DPoP challenges, and concurrent requests reaching the application tier. Its impact is focused on **data confidentiality**, with low integrity impact, no availability impact, a low EPSS score, and no listing in CISA’s Known Exploited Vulnerabilities catalog.
Jun 29, 2026
Progress disclosed two high-severity vulnerabilities in **Customer Managed ShareFile Storage Zones Controller (SZC)** that could expose organizations to unauthorized access and remote code execution. **`CVE-2026-2699`** allows an unauthenticated attacker to reach restricted configuration pages, creating a path to unauthorized system configuration changes and possible code execution. The flaw is rated **CVSS 9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) and is associated with **CWE-284** and **CWE-698**. A second issue, **`CVE-2026-2701`**, allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution in ShareFile SZC environments. That vulnerability carries a **CVSS 8.8** rating (`AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`) and is mapped to **CWE-94**, **CWE-78**, and **CWE-434**. The disclosures reference vendor security guidance for ShareFile and indicate that both flaws can significantly affect confidentiality, integrity, and availability in customer-managed deployments.
Jun 29, 2026