CRITICAL 9.1 NVD
CVE-2026-72575
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.
References
- https://github.com/daptin/daptin
- https://github.com/daptin/daptin/blob/master/server/permission/permission.go
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-08-10 via NVD.
Risk Timeline
CVE Disclosed2026-08-10 · -1 days ago
Remediation Resources
vulnfeed aggregates 9095 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.