Critical

daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

Type: advisorySources: OSV

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-72575
Confirmed fixed CVEs: Not specified
Updated in this feed: 2 Nov 2026, 21:27 UTC · Revision 1

Source evidence

daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

core-osv · Original source

Published 10 Aug 2026, 10:41 UTC

osv:CVE-2026-72575

Complete source record

{
  "id": "f2cc8669ac5ff87762801047dd91655ad68aaf6e99814184b5998af9832739e1",
  "url": "https://osv.dev/vulnerability/CVE-2026-72575",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects",
    "summary": "An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.",
    "evidence": "osv:CVE-2026-72575",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-72575",
      "aliases": [
        "CVE-2026-72575"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/daptin/daptin",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "b1ce2791de987726565aeac87846cfa86af66990"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "v0.12.34"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.12.34"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.12.34",
            "v0.12.33",
            "v0.12.32",
            "v0.12.31",
            "v0.12.30",
            "v0.12.29",
            "v0.12.28",
            "v0.12.27",
            "v0.12.26",
            "v0.12.25",
            "v0.12.24",
            "v0.12.23",
            "v0.12.22",
            "v0.12.21",
            "v0.12.20",
            "v0.12.19",
            "v0.12.18",
            "v0.12.17",
            "v0.12.16",
            "v0.12.15",
            "v0.12.14",
            "v0.12.13",
            "v0.12.12",
            "v0.12.11",
            "v0.12.10",
            "v0.12.9",
            "v0.12.8",
            "v0.12.7",
            "v0.12.6",
            "v0.12.5",
            "v0.12.4",
            "v0.12.3",
            "v0.12.2",
            "v0.12.1",
            "v0.11.8",
            "v0.11.7",
            "v0.12.0",
            "v0.11.6",
            "v0.11.5",
            "v0.11.4",
            "v0.11.3",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "0.10.3",
            "0.10.2",
            "0.10.1",
            "v0.10.0",
            "v0.9.10",
            "v0.9.9",
            "v0.9.82",
            "v0.9.81",
            "v0.9.8",
            "v0.9.7",
            "v0.9.6",
            "v0.9.5",
            "v0.9.4",
            "v0.9.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72575.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.641103746Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72575.json",
        "https://github.com/daptin/daptin",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-72575",
        "https://github.com/daptin/daptin/blob/master/server/permission/permission.go"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-284"
        ],
        "cna_assigner": "TuranSec",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72575.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-72575",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 490228,
  "published_at": "2026-08-10T10:41:00.708+00:00"
}