Threats tagged 'ghsa-mgp5-77q8-6g32'

Directus versions before 12.1.0 have an authorization bypass vulnerability. This flaw allows unauthenticated attackers to bypass permission checks on public-mode WebSocket connections by sending a failed authentication message with an invalid token. As a result, attackers can perform read, create, update, or delete operations on any user-defined collection without proper authorization.