CVE-2024-39701: Directus Auth Bypass Vulnerability

CVE-2024-39701 Overview

CVE-2024-39701 is a broken access control vulnerability in Directus, a real-time API and application dashboard for managing SQL database content. Affected versions from 9.23.0 through 10.5.3 improperly handle the _in and _nin filter operators. The engine evaluates empty arrays as valid matches, causing permission rules such as {"role": {"_in": $CURRENT_USER.some_field}} to return true when the referenced field is empty. Authenticated attackers can bypass intended access controls and reach data or actions that should be restricted. The issue is tracked under [CWE-284: Improper Access Control] and is fixed in version 10.6.0.

Critical Impact
Authenticated users can bypass Directus permission rules that rely on _in or _nin operators when the compared field resolves to an empty array, exposing restricted data.

Affected Products

Monospace Directus >= 9.23.0
Monospace Directus <= 10.5.3
Fixed in Monospace Directus 10.6.0

Discovery Timeline

2024-07-08 - CVE-2024-39701 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39701

Vulnerability Analysis

Directus uses a permission filter system that lets administrators restrict item access using operators including _in (value must appear in list) and _nin (value must not appear in list). These operators are commonly combined with dynamic values such as $CURRENT_USER.some_field to enforce row-level access. In affected releases, the filter evaluator treats an empty array on the right-hand side of _in as a passing condition rather than a failing one. The rule then admits every candidate record instead of restricting matches to the expected list.

An authenticated attacker whose $CURRENT_USER.some_field resolves to an empty array satisfies any rule structured as {"field": {"_in": $CURRENT_USER.some_field}}. The API returns records that policy authors intended to gate behind a positive membership check. Because the flaw sits in the shared filter evaluator, any collection or endpoint governed by this pattern inherits the bypass.

Root Cause

The root cause is incorrect boundary handling in the _in and _nin operator implementations. The evaluator does not distinguish an empty comparison set from a wildcard match. A safe implementation must fail closed when the comparison list is empty, since no value can legitimately be a member of an empty set.

Attack Vector

Exploitation requires network access to the Directus API and low-privileged authentication. No user interaction is required. An attacker crafts standard API queries against collections whose access rules rely on _in or _nin combined with a dynamic user attribute. If the attribute is unset or empty for the attacker's account, the rule passes and the API returns unauthorized data.

// Vulnerable rule pattern (conceptual)
// See the GitHub Security Advisory for authoritative details
{
  "role": {
    "_in": "$CURRENT_USER.some_field"
  }
}
// When $CURRENT_USER.some_field resolves to [],
// the affected evaluator returns true instead of false.

Refer to the GitHub Security Advisory GHSA-hxgm-ghmv-xjjm for authoritative technical detail.

Detection Methods for CVE-2024-39701

Indicators of Compromise

Unexpected API responses returning records to accounts whose role or scope should exclude them.
Audit log entries showing successful reads or writes on collections gated by _in or _nin rules from low-privileged users.
Spikes in query volume against permission-sensitive collections from newly created or dormant accounts.

Detection Strategies

Review Directus permission definitions for rules using _in or _nin bound to dynamic values like $CURRENT_USER.* and confirm the referenced fields are always populated.
Correlate application logs with identity data to flag responses whose returned record scope exceeds the requester's expected role.
Query the Directus directus_activity table for unusual read patterns preceding data exfiltration attempts.

Monitoring Recommendations

Alert on API responses whose row counts materially exceed historical baselines for a given user or role.
Monitor authentication events for accounts with empty or null values in fields referenced by permission rules.
Track deployment inventory to identify Directus instances still running versions between 9.23.0 and 10.5.3.

How to Mitigate CVE-2024-39701

Immediate Actions Required

Upgrade Directus to version 10.6.0 or later, which corrects the empty-array handling in the _in and _nin operators.
Audit all permission rules that reference dynamic user attributes and confirm those attributes are always populated for active accounts.
Rotate API tokens and session credentials if audit logs show suspicious access during the exposure window.

Patch Information

The vulnerability is fixed in Directus 10.6.0. Details are published in the Directus GitHub Security Advisory GHSA-hxgm-ghmv-xjjm. Operators running self-hosted deployments should upgrade the Docker image or npm package to 10.6.0 or newer and restart the service.

Workarounds

Rewrite affected rules to avoid _in and _nin against fields that can be empty, for example by combining them with a _nnull check on the same field.
Enforce data integrity so that fields referenced by permission rules cannot be null or empty for authenticated accounts.
Restrict API access at the network layer to trusted clients until the patched version is deployed.

bash

# Upgrade a self-hosted Directus deployment to the patched release
docker pull directus/directus:10.6.0
docker stop directus && docker rm directus
docker run -d --name directus \
  -p 8055:8055 \
  --env-file ./directus.env \
  directus/directus:10.6.0