CVE-2024-39701 Directus Incorrectly handles _in` filter

What is CVE-2024-39701?

CVE-2024-39701 is a medium-severity missing authorization vulnerability in Monospace Directus, published on 8 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the rule fails to do what it was intended to do: Pass rule if **field** matches any of the **values**. This vulnerability is fixed in 10.6.0.

Weakness: CWE-284

Which versions are affected by CVE-2024-39701?

2 open source packages ship an affected version, including directus. It affects 1 product.

Products include Monospace Directus.

How do I fix CVE-2024-39701?

Upgrade directus to 10.6.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-39701 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39701 exists.

Other vulnerabilities in Monospace Directus

• CVE-2022-26969 Insecure default value for CORS configuration Critical 9.8
• CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization Critical 9.3
• CVE-2026-35408 Directus is Missing Cross-Origin Opener Policy High 8.7
• CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key High 8.6
• CVE-2025-30353 Directus's webhook trigger flows can leak sensitive data High 8.6

All Monospace Directus vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hxgm-ghmv-xjjm.