CVE-2026-72575 in Daptin
Summary
by MITRE • 08/10/2026
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it. Since usergroup table rows have no user_account_id and are loaded with a null owner, an unauthenticated guest whose session UserId is null gains full CRUD access to all usergroup objects.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authorization flaw in the daptin application affecting versions up to v0.12.34. The issue stems from inconsistent permission validation logic within the server-side authorization framework where the permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, and CanRefer exhibit flawed behavior when handling null user identifiers. The core technical flaw occurs in the server/permission/permission.go file where the authorization logic incorrectly grants full access privileges to unauthenticated users by returning true whenever p.UserId matches the requesting userId without properly validating that the userId is not null or zero. This design inconsistency creates a security gap where guest users with null session identifiers can bypass authentication requirements and gain complete control over usergroup records.
The operational impact of this vulnerability is severe as it allows unauthenticated remote attackers to perform all critical data operations including reading sensitive usergroup information, creating new usergroup entries, modifying existing records, deleting usergroup objects, and establishing references between entities. The flaw specifically targets the usergroup table functionality since these database rows are designed without explicit user_account_id associations and are loaded with null owners, making them particularly vulnerable to unauthorized access. This creates a scenario where any attacker can establish a session with a null userId and immediately gain unrestricted access to all usergroup data within the system, effectively bypassing the entire authentication and authorization mechanism.
Security researchers should note that this vulnerability aligns with CWE-285 (Improper Authorization) and represents a specific implementation flaw in permission checking logic that fails to properly validate null identifiers. The inconsistency between how different permission functions handle null values creates an exploitable gap where CanExecute correctly guards against null references while other functions do not, demonstrating poor defensive programming practices. From an ATT&CK perspective, this vulnerability maps to T1078 (Valid Accounts) and T1566 (Phishing) as attackers can leverage the lack of proper authorization controls to gain unauthorized access to usergroup data without needing valid credentials. The vulnerability also relates to T1484 (External Remote Services) since it enables remote exploitation without authentication requirements, potentially allowing attackers to perform lateral movement or data exfiltration operations through compromised usergroup records.
Organizations using daptin should immediately implement mitigations including patching to versions beyond v0.12.34 where the authorization logic has been corrected, implementing additional validation checks that explicitly reject null userId values in all permission functions, and conducting thorough audits of similar permission checking patterns throughout the application codebase. The fix should ensure that all permission validation functions properly check for null or zero user identifiers before granting access privileges, establishing consistent behavior across all authorization checks. Additionally, system administrators should review existing usergroup data for potential unauthorized modifications and implement monitoring solutions to detect suspicious access patterns related to null userId sessions.