Pain point · Permissions & security · Causes churn
Version updates bypass item read-access checks
1 source thread · first seen 2026-09
Summary
PATCH requests can repoint a caller's version to an item they cannot read, unlike version creation. This can enable content injection on inaccessible items and probing for existing version keys.
- Affects
- Directus users with create, read, and update access to directus_versions
Evidence
Excerpts are copied word for word from the source; follow the link to read it in full.
“`PATCH /versions/{id}` and `PATCH /versions` don't enforce the same check”