CVE-2026-54322 json
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
published 2026-06-16 4 mo ago modified 2026-10-25 14 d ago also GHSA-qxvm-pcfm-qc39 , GO-2026-5600 , EUVD-2026-38563
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the target role by its identifier alone, without verifying the role belonged to that organization. An authenticated user who owns any organization (organizations are self-service) could therefore modify the permissions of, or delete, a role belonging to a different organization, given that role's identifier. This vulnerability is fixed in 0.185.0.
Patch / fix
- go github.com/daytonaio/daytona 0.185.0
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/daytonaio/daytona | <0.185.0 |
0.185.0 |
Affected products
- daytonaio daytona
Classification
References
Sources
- CVE List CVE-2026-54322
- GitHub Advisory GHSA-qxvm-pcfm-qc39
- NVD CVE-2026-54322
- OSV GO-2026-5600
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.