CVE-2022-26969
Insecure default value for CORS configuration
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
- Record
CVE-2022-26969- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-942
- Updated
- 2026-11-02
CVE List
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
- Record
CVE-2022-26969- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-942
- Updated
- 2026-11-02
EUVDEUVD-2022-1731
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
- Record
EUVD-2022-1731- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g27j-74fp-xfpr
Insecure default value for CORS configuration
Impact
The default value for the CORS_ENABLED and CORS_ORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.
Patches
The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0
Workarounds
Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.
For more information
If you have any questions or comments about this advisory:
- Open an issue in directus/directus
- Email us at [email protected]
- Record
GHSA-g27j-74fp-xfpr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-942
- Updated
- 2026-11-02
OSV
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
- Record
CVE-2022-26969- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-g27j-74fp-xfpr
Insecure default value for CORS configuration
Impact
The default value for the CORS_ENABLED and CORS_ORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.
Patches
The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0
Workarounds
Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.
For more information
If you have any questions or comments about this advisory:
- Open an issue in directus/directus
- Email us at [email protected]
- Record
GHSA-g27j-74fp-xfpr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-942
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
directusnpm |
before 9.7.0 | 9.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26969 is a critical vulnerability (CVSS 9.8) in Monospace Directus, published April 5, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in directus 9.7.0.
References
github.com/directus/directus/blob/8daed9c41baeaf1d08c1e292bf9f0dcef65e48fb/docs/configuration/config-options.md
security.snyk.io/vuln/SNYK-JS-DIRECTUS-2441822
developer.mozilla.org/en-US/docs/Web/HTTP/CORS