- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 59
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
- Hall of fame
-
Yes
Reporters are credited in the release notes of the fix.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://directus.io
Products and areas 11
- Authentication across every method the product supports: local login, refresh-token handling, static API tokens, and the OAuth2, OpenID Connect, LDAP and SAML providers
- File storage and the asset endpoint, including image transformation, storage adapters and the routes that serve files back
- Flows and Operations, the automation runtime that fires on triggers and executes work with the project's own credentials
- Schema management, migrations and the import and export routines that read and write project data in bulk
- The admin app in its entirety, and every setting an administrator can change on a running project
- The extensions API and the sandbox around custom endpoints, hooks, operations and interfaces
- The GraphQL API, including the schema it generates from a project's collections and the resolvers behind it
- The permissions and access-policy engine end to end, covering role assignment, collection and field-level rules, item-level filter rules and the filter language those rules are written in
- The policy asks for any vulnerability through a GitHub private advisory or the security address, and draws no boundary narrower than the Directus platform itself
- The realtime and websocket subscription layer, which pushes item changes to connected clients under the same permission rules
- The REST API in full: every collection, item, field and relational endpoint a client can reach, whatever is on the other end
Out of scope (6)
- A permission an administrator configured deliberately, including a public role granted read access on purpose
- Deployment configuration: storage adapter credentials, reverse-proxy setup and environment variables the operator set
- The hosted Directus Cloud control plane where the finding is about the operator's infrastructure rather than the codebase
- The policy publishes no exclusions list, so nothing is carved out by name. What follows are genuine out-of-scope classes
- Third-party community extensions that are not part of the Directus repository
- Upstream database engines and Node dependencies, unless Directus's own use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
File a GitHub private security advisory on directus/directus , the channel the policy prefers. the address on the policy page is the documented alternative
-
Do not route through directus.io/security. It redirects to a SOC 2 trust centre with no reporting address, and the domain publishes no security.txt
-
Name the database engine and give the exact role, policy and permission configuration the finding reproduces under, since almost everything here is decided by that configuration
-
Report against a current release rather than an older major
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 59 CVEs, 20 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 20 Last 12 months 59 Lifetime Access control 40 % Auth bypass 25 % Injection 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Directus wraps a real SQL database in a REST and GraphQL API plus an admin app, so a team points it at Postgres or MySQL and gets a headless CMS over tables they already own. Around 48 million Docker pulls and 88,000 npm installs a month, mostly running as the backend for somebody else's product. The permission engine is what everything rests on, since a Directus role is the only thing between a public API token and every row in the database behind it. Twenty advisories landed in the last twelve months, one of them critical, and the project pays for none of them, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy asks for any vulnerability through a GitHub private advisory or the security address, and draws no boundary narrower than the Directus platform itself The REST API in full: every collection, item, field and relational endpoint a client can reach, whatever is on the other end The GraphQL API, including the schema it generates from a project's collections and the resolvers behind it The permissions and access-policy engine end to end, covering role assignment, collection and field-level rules, item-level filter rules and the filter language those rules are written in Authentication across every method the product supports: local login, refresh-token handling, static API tokens, and the OAuth2, OpenID Connect, LDAP and SAML providers Flows and Operations, the automation runtime that fires on triggers and executes work with the project's own credentials The extensions API and the sandbox around custom endpoints, hooks, operations and interfaces File storage and the asset endpoint, including image transformation, storage adapters and the routes that serve files back The admin app in its entirety, and every setting an administrator can change on a running project The realtime and websocket subscription layer, which pushes item changes to connected clients under the same permission rules Schema management, migrations and the import and export routines that read and write project data in bulk Out of scope The policy publishes no exclusions list, so nothing is carved out by name. What follows are genuine out-of-scope classes The hosted Directus Cloud control plane where the finding is about the operator's infrastructure rather than the codebase Upstream database engines and Node dependencies, unless Directus's own use of them is what makes the issue reachable Third-party community extensions that are not part of the Directus repository A permission an administrator configured deliberately, including a public role granted read access on purpose Deployment configuration: storage adapter credentials, reverse-proxy setup and environment variables the operator set Most-valued findings Permission-engine bypass above everything else: a role reading or writing a collection, an item or a field its policies do not grant. Twenty advisories landed in the window and this is the class the whole product is built to enforce Anything the unauthenticated public role reaches, since a defect there is exploitable against every Directus instance exposed to the internet at once Filter and query parameter handling that passes request input into the database layer, where the same parameter surface that expresses permissions also expresses queries Token handling across static API tokens, refresh tokens and session cookies, particularly a token that outlives its revocation or reaches a project it was not issued for Identity binding in the OAuth, OIDC, LDAP and SAML paths, where an attacker-controlled identity attaches to an existing account Escapes from the extension sandbox, and Flows operations that reach the host or evaluate an expression a lower-privileged user supplied The asset endpoint and its image transformation path, both for server-side request forgery and for reading files the project never stored Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. File a GitHub private security advisory on directus/directus , the channel the policy prefers. [email protected] is the documented alternative The policy lives at lowercase security.md in the repository root. The conventional uppercase path returns a 404, so tooling that only checks the standard filename will report no policy where there is one Credit in the release notes of the fix is the reward the policy commits to. There is no payment to negotiate Do not route through directus.io/security. It redirects to a SOC 2 trust centre with no reporting address, and the domain publishes no security.txt Name the database engine and give the exact role, policy and permission configuration the finding reproduces under, since almost everything here is decided by that configuration Report against a current release rather than an older major Disclosure Coordinated through the GitHub advisory flow or the security address, published as a GHSA on directus/directus alongside a patched release. Publication is batched and release-tied, with nine advisories on 2 April 2026 and four on 13 November 2025, so plan for an embargo that runs to the next security release rather than to a published day count. Reporters are credited in the release notes of the fix. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability