Back to Database
Status published
Medium
CVE-2024-6534
Directus 10.13.0 - Insecure object reference via PATH presets
Vulnerability Description
Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6534
Credits & Attribution
No credits recorded in the NVD database.
Affected Vendor
Directus
View all reports →Affected Software
Directus
Vulnerable Versions:
10.13.0
Timeline
Official Publish:
August 15th, 2024
Last Modified:
May 19th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N