CVE-2026-72575

critical · 9.1

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.

9.1

CVSS

0.5%

EPSS (exploit prob.)

42nd

EPSS percentile

2026-08-10

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-284

References

https://github.com/daptin/daptin
https://github.com/daptin/daptin/blob/master/server/permission/permission.go

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-72575