-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from divergent data fetching logic between REST and GraphQL endpoints. The patch (#19155) explicitly states it 'uses the same data fetching logic for both REST and GraphQL subscriptions,' indicating the GraphQL subscription handlers previously lacked proper permission checks. The SubscriptionService.subscribe function would be directly responsible for real-time updates, while ItemsService.readByQuery is a core data fetching method that might have been context-agnostic in GraphQL mode. The high confidence for SubscriptionService comes from the patch's focus on subscription handling, while ItemsService gets medium confidence as the underlying mechanism that might have been improperly contextualized.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | >= 10.3, < 10.5.0 | 10.5.0 |