What is CVE-2024-46990?

CVE-2024-46990 is a medium-severity vulnerability in Directus, classified under Improper Access Control. CVSS score: 5.0/10. Published 2024-09-18.

How severe is CVE-2024-46990?

Medium severity. CVSS v3 base score is 5.0 out of 10.

Is CVE-2024-46990 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Directus

CVE-2024-46990

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.

Published 2024-09-18 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.005 (38.0th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 38.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000

Affected products

Directus — versions < 10.13.3, >= 11.0.0, < 11.1.0
Monospace Directus

Weakness classification (CWE)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m (Mitigation, Vendor Advisory)
github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b (Patch)
github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52 (Patch)
github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff (Patch)
github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431 (Patch)

Frequently asked questions

What is CVE-2024-46990?: CVE-2024-46990 is a medium-severity vulnerability in Directus, classified under Improper Access Control. CVSS score: 5.0/10. Published 2024-09-18.
How severe is CVE-2024-46990?: Medium severity. CVSS v3 base score is 5.0 out of 10.
Is CVE-2024-46990 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.