CVE-2026-72575

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-72575

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72575.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-72575

Published

2026-08-10T10:41:00Z

Modified

2026-09-05T03:31:05Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

Details

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.

Database specific

{
    "cna_assigner": "TuranSec",
    "cwe_ids": [
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72575.json"
}

References

Affected packages

Git / github.com/daptin/daptin

Affected ranges

Type

GIT

Repo

https://github.com/daptin/daptin

Events

Introduced

Fixed

b1ce2791de987726565aeac87846cfa86af66990

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "v0.12.34"
        },
        {
            "fixed": "v0.12.34"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*

0.10.1

0.10.2

0.10.3

v0.*

v0.10.0

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.11.7

v0.11.8

v0.12.0

v0.12.1

v0.12.10

v0.12.11

v0.12.12

v0.12.13

v0.12.14

v0.12.15

v0.12.16

v0.12.17

v0.12.18

v0.12.19

v0.12.2

v0.12.20

v0.12.21

v0.12.22

v0.12.23

v0.12.24

v0.12.25

v0.12.26

v0.12.27

v0.12.28

v0.12.29

v0.12.3

v0.12.30

v0.12.31

v0.12.32

v0.12.33

v0.12.4

v0.12.5

v0.12.6

v0.12.7

v0.12.8

v0.12.9

v0.9.10

v0.9.2

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.81

v0.9.82

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72575.json"