CVE-2026-35412

CVE-2026-35412 is an authorization bypass vulnerability affecting Directus versions prior to 11.16.1, a real-time API and database management platform. The TUS resumable upload endpoint (/files/tus) fails to enforce item-level access controls, allowing authenticated users with basic file upload permissions to overwrite arbitrary files by UUID. While the standard REST upload path correctly enforces row-level permission rules, the TUS endpoint bypasses these restrictions entirely, enabling privilege escalation and unauthorized file modification. The vulnerability carries a CVSS score of 8.1 (HIGH) with a network-based attack vector requiring low complexity and valid credentials but no user interaction. The impact is significant, affecting both integrity and availability through unauthorized file overwriting, though confidentiality is not compromised. The EPSS score of 0.00012 indicates minimal exploitation prevalence currently. There is no evidence of active exploitation in the wild, and the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog. Community attention appears limited, with the flaw addressed through a straightforward version upgrade to 11.16.1. Organizations running affected versions should prioritize patching to remediate the authorization bypass.