CVE-2024-6534: Directus 10.13.0 - Insecure object reference via PATH presets

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-15 · updated 2026-06-17
Weakness: CWE-639

Description

Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.

Affected products

directus: 10.13.0

References

https://directus.io/
https://fluidattacks.com/advisories/capaldi

Get alerted when CVE-2024-6534 or the next vulnerability affects your stack