Vulnerability · Published Aug 10, 2026 · Assigned by TuranSec

CVE-2026-72575daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

Critical 9.1

In plain English

A critical-severity improper access control in daptin from daptin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 55.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.

Affected products (as reported)

Vendor	Product	Versions
daptin	daptin	0 – through v0.12.34

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Product third-party-advisory
Vulnerable File technical-description