CVE-2021-26594

CVE-2021-26594 describes a critical access control vulnerability in Directus versions 8.x through 8.8.1, allowing an authenticated attacker to elevate their privileges to an administrator role without backend validation. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk due to its network-based attack vector, low attack complexity, and high potential for complete compromise of confidentiality, integrity, and availability. While no public exploit code (Metasploit, Nuclei, ExploitDB) or active exploitation (KEV, Hot List) has been identified, and community discussion is minimal, the vulnerability's ease of exploitation and significant impact warrant attention, especially for organizations still using unsupported Directus versions.