CVE-2026-72575
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions return true when the user ID matches but fail to reject the null/zero reference, enabling bypass.
Risk Assessment
The risk includes unauthorized access to usergroup data, modification or deletion, potentially leading to integrity and confidentiality breaches.
Recommendation
Immediately update daptin to the latest patched version and implement additional authorization mechanisms.
Other vulnerabilities in daptin
See all- CVE-2026-41422High
Daptin is a headless CMS based on GraphQL/JSON-API. In versions prior to 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed without validation, allowing authenticated users to inject arbitrary SQL expressions.
- CVE-2026-62160High
In Daptin (a GraphQL/JSON-API headless CMS) before 0.12.26, the global LanguageMiddleware passes the raw Accept-Language header to golang.org/x/text without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, so long lists of underscore-separated language subtags bypass it and cause quadratic buffer processing. Unauthenticated requests to the public landing page or /api can exhaust server CPU.
- CVE-2025-15439Medium
In Daptin 0.10.3, the goqu.L function in server/resource/resource_aggregate.go of the Aggregate API component is vulnerable to SQL injection via manipulation of the column/group/order arguments. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS