CVE-2026-54322

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54322
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54322.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54322
Aliases
Published
2026-06-23T18:07:59.639Z
Modified
2026-07-15T01:49:16.199487001Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L CVSS Calculator
Summary
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
Details

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the target role by its identifier alone, without verifying the role belonged to that organization. An authenticated user who owns any organization (organizations are self-service) could therefore modify the permissions of, or delete, a role belonging to a different organization, given that role's identifier. This vulnerability is fixed in 0.185.0.

Database specific 
{
    "cwe_ids": [
        "CWE-639",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54322.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/daytonaio/daytona

Affected ranges

Type
GIT
Repo
https://github.com/daytonaio/daytona
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
39f970a8f5d7e1110fad672cfa49200f725beb83
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.185.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

libs/api-client-go/v0.*
libs/api-client-go/v0.137.0
libs/api-client-go/v0.138.0
libs/api-client-go/v0.139.0
libs/api-client-go/v0.140.0
libs/api-client-go/v0.141.0
libs/api-client-go/v0.142.0
libs/api-client-go/v0.143.0
libs/api-client-go/v0.144.0
libs/api-client-go/v0.144.1
libs/api-client-go/v0.145.0
libs/api-client-go/v0.146.0
libs/api-client-go/v0.147.0
libs/api-client-go/v0.148.0
libs/api-client-go/v0.149.0
libs/api-client-go/v0.150.0
libs/api-client-go/v0.151.0
libs/api-client-go/v0.152.0
libs/api-client-go/v0.152.1
libs/api-client-go/v0.153.0
libs/api-client-go/v0.154.0
libs/api-client-go/v0.155.0
libs/api-client-go/v0.156.0
libs/api-client-go/v0.157.0
libs/api-client-go/v0.158.0
libs/api-client-go/v0.158.1
libs/api-client-go/v0.159.0
libs/api-client-go/v0.160.0
libs/api-client-go/v0.161.0
libs/api-client-go/v0.162.0
libs/api-client-go/v0.163.0
libs/api-client-go/v0.164.0
libs/api-client-go/v0.165.0
libs/api-client-go/v0.166.0
libs/api-client-go/v0.167.0
libs/api-client-go/v0.168.0
libs/api-client-go/v0.169.0
libs/api-client-go/v0.170.0
libs/api-client-go/v0.171.0
libs/api-client-go/v0.172.0
libs/api-client-go/v0.173.0
libs/api-client-go/v0.174.0
libs/api-client-go/v0.175.0
libs/api-client-go/v0.176.0
libs/api-client-go/v0.177.0
libs/api-client-go/v0.178.0
libs/api-client-go/v0.179.0
libs/api-client-go/v0.180.0
libs/api-client-go/v0.181.0
libs/api-client-go/v0.182.0
libs/api-client-go/v0.183.0
libs/api-client-go/v0.184.0
libs/sdk-go/v0.*
libs/sdk-go/v0.137.0
libs/sdk-go/v0.138.0
libs/sdk-go/v0.139.0
libs/sdk-go/v0.140.0
libs/sdk-go/v0.141.0
libs/sdk-go/v0.142.0
libs/sdk-go/v0.143.0
libs/sdk-go/v0.144.0
libs/sdk-go/v0.144.1
libs/sdk-go/v0.145.0
libs/sdk-go/v0.146.0
libs/sdk-go/v0.147.0
libs/sdk-go/v0.148.0
libs/sdk-go/v0.149.0
libs/sdk-go/v0.150.0
libs/sdk-go/v0.151.0
libs/sdk-go/v0.152.0
libs/sdk-go/v0.152.1
libs/sdk-go/v0.153.0
libs/sdk-go/v0.154.0
libs/sdk-go/v0.155.0
libs/sdk-go/v0.156.0
libs/sdk-go/v0.157.0
libs/sdk-go/v0.158.0
libs/sdk-go/v0.158.1
libs/sdk-go/v0.159.0
libs/sdk-go/v0.160.0
libs/sdk-go/v0.161.0
libs/sdk-go/v0.162.0
libs/sdk-go/v0.163.0
libs/sdk-go/v0.164.0
libs/sdk-go/v0.165.0
libs/sdk-go/v0.166.0
libs/sdk-go/v0.167.0
libs/sdk-go/v0.168.0
libs/sdk-go/v0.169.0
libs/sdk-go/v0.170.0
libs/sdk-go/v0.171.0
libs/sdk-go/v0.172.0
libs/sdk-go/v0.173.0
libs/sdk-go/v0.174.0
libs/sdk-go/v0.175.0
libs/sdk-go/v0.176.0
libs/sdk-go/v0.177.0
libs/sdk-go/v0.178.0
libs/sdk-go/v0.179.0
libs/sdk-go/v0.180.0
libs/sdk-go/v0.181.0
libs/sdk-go/v0.182.0
libs/sdk-go/v0.183.0
libs/sdk-go/v0.184.0
libs/toolbox-api-client-go/v0.*
libs/toolbox-api-client-go/v0.137.0
libs/toolbox-api-client-go/v0.138.0
libs/toolbox-api-client-go/v0.139.0
libs/toolbox-api-client-go/v0.140.0
libs/toolbox-api-client-go/v0.141.0
libs/toolbox-api-client-go/v0.142.0
libs/toolbox-api-client-go/v0.143.0
libs/toolbox-api-client-go/v0.144.0
libs/toolbox-api-client-go/v0.144.1
libs/toolbox-api-client-go/v0.145.0
libs/toolbox-api-client-go/v0.146.0
libs/toolbox-api-client-go/v0.147.0
libs/toolbox-api-client-go/v0.148.0
libs/toolbox-api-client-go/v0.149.0
libs/toolbox-api-client-go/v0.150.0
libs/toolbox-api-client-go/v0.151.0
libs/toolbox-api-client-go/v0.152.0
libs/toolbox-api-client-go/v0.152.1
libs/toolbox-api-client-go/v0.153.0
libs/toolbox-api-client-go/v0.154.0
libs/toolbox-api-client-go/v0.155.0
libs/toolbox-api-client-go/v0.156.0
libs/toolbox-api-client-go/v0.157.0
libs/toolbox-api-client-go/v0.158.0
libs/toolbox-api-client-go/v0.158.1
libs/toolbox-api-client-go/v0.159.0
libs/toolbox-api-client-go/v0.160.0
libs/toolbox-api-client-go/v0.161.0
libs/toolbox-api-client-go/v0.162.0
libs/toolbox-api-client-go/v0.163.0
libs/toolbox-api-client-go/v0.164.0
libs/toolbox-api-client-go/v0.165.0
libs/toolbox-api-client-go/v0.166.0
libs/toolbox-api-client-go/v0.167.0
libs/toolbox-api-client-go/v0.168.0
libs/toolbox-api-client-go/v0.169.0
libs/toolbox-api-client-go/v0.170.0
libs/toolbox-api-client-go/v0.171.0
libs/toolbox-api-client-go/v0.172.0
libs/toolbox-api-client-go/v0.173.0
libs/toolbox-api-client-go/v0.174.0
libs/toolbox-api-client-go/v0.175.0
libs/toolbox-api-client-go/v0.176.0
libs/toolbox-api-client-go/v0.177.0
libs/toolbox-api-client-go/v0.178.0
libs/toolbox-api-client-go/v0.179.0
libs/toolbox-api-client-go/v0.180.0
libs/toolbox-api-client-go/v0.181.0
libs/toolbox-api-client-go/v0.182.0
libs/toolbox-api-client-go/v0.183.0
libs/toolbox-api-client-go/v0.184.0
v0.*
v0.1.0
v0.10.0
v0.100.0
v0.101.0
v0.102.0
v0.103.0
v0.104.0
v0.104.1
v0.105.0
v0.106.0
v0.106.1
v0.106.2
v0.106.3
v0.107.0
v0.107.1
v0.108.0
v0.108.1
v0.109.0
v0.11.0
v0.110.0
v0.110.2
v0.111.0
v0.111.1
v0.112.0
v0.112.1
v0.112.2
v0.112.3
v0.113.0
v0.113.1
v0.114.0
v0.115.0
v0.115.1
v0.115.2
v0.116.0
v0.117.0
v0.118.0
v0.119.0
v0.12.0
v0.12.0-alpha
v0.12.1
v0.120.0
v0.120.1
v0.121.0
v0.122.0
v0.123.0
v0.124.0
v0.124.1
v0.125.0
v0.126.0
v0.127.0
v0.128.0
v0.128.1
v0.129.0
v0.13.0
v0.130.0
v0.131.0
v0.132.0
v0.133.0
v0.134.0
v0.135.0
v0.136.0
v0.137.0
v0.137.1
v0.138.0
v0.139.0
v0.14.0
v0.140.0
v0.141.0
v0.142.0
v0.143.0
v0.144.0
v0.144.1
v0.145.0
v0.146.0
v0.147.0
v0.148.0
v0.149.0
v0.15.0
v0.150.0
v0.151.0
v0.152.0
v0.152.1
v0.153.0
v0.154.0
v0.155.0
v0.156.0
v0.157.0
v0.158.0
v0.158.1
v0.159.0
v0.16.0
v0.160.0
v0.161.0
v0.162.0
v0.163.0
v0.164.0
v0.165.0
v0.166.0
v0.167.0
v0.168.0
v0.169.0
v0.17.0
v0.170.0
v0.171.0
v0.172.0
v0.173.0
v0.174.0
v0.175.0
v0.176.0
v0.177.0
v0.178.0
v0.179.0
v0.18.0
v0.180.0
v0.181.0
v0.182.0
v0.183.0
v0.184.0
v0.19.0
v0.19.1
v0.2.0
v0.20.0
v0.21.0
v0.21.1
v0.21.2
v0.21.3
v0.22.0
v0.22.1
v0.23.0
v0.23.1
v0.24.0
v0.25.0
v0.25.1
v0.25.2
v0.26.0
v0.26.1
v0.27.0
v0.28.0
v0.28.1
v0.29.0
v0.29.1
v0.3.0
v0.3.1
v0.30.0
v0.30.1
v0.31.0
v0.31.0-beta.1
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.37.0
v0.38.0
v0.39.0
v0.4.0
v0.4.1
v0.40.0
v0.41.0
v0.42.0
v0.42.1
v0.43.0
v0.44.0
v0.44.1
v0.45.0
v0.46.0
v0.46.1
v0.47.0
v0.48.0
v0.49.0
v0.5.0
v0.50.0
v0.51.0
v0.52.0
v0.52.1
v0.53.0
v0.6.0
v0.7.0
v0.7.1
v0.8.0
v0.8.1
v0.8.2
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54322.json"