CVE-2026-72575 json
daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects
published 2026-08-10 2 mo ago modified 2026-10-24 16 d ago also EUVD-2026-55231
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
- daptin daptin
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/daptin/daptin
third-party-advisory
-
github.com
/daptin/daptin/blob/master/server/permission/permission.go
technical-description
Sources
- CVE List CVE-2026-72575
- NVD CVE-2026-72575
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.