CVE-2026-72575

Published: Aug 10, 2026Modified: Sep 3, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (Secondary)

Description

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://github.com/daptin/daptin

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

https://github.com/daptin/daptin/blob/master/server/permission/permission.go

Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Timeline

No history available yet.