CVE-2026-72575

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72575", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-10T10:32:53.854Z", "datePublished": "2026-08-10T10:41:00.708Z", "dateUpdated": "2026-08-10T18:22:43.886Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:50.994Z"}, "title": "daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects", "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference \u2014 unlike CanExecute, which explicitly guards it.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference \u2014 unlike CanExecute, which explicitly guards it.</p>"}]}], "affected": [{"vendor": "daptin", "product": "daptin", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "v0.12.34"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/daptin/daptin", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/daptin/daptin/blob/master/server/permission/permission.go", "name": "Vulnerable File", "tags": ["technical-description"]}], "credits": [{"lang": "en", "value": "Komiljon Ayubov", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "timeline": [{"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "CVE Reserved"}, {"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "Public Disclosure"}], "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-10T10:32:53.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T15:52:21.769337Z", "id": "CVE-2026-72575", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:22:43.886Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72575", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T15:52:21.769337Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T15:52:31.800Z"}}], "cna": {"title": "daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Komiljon Ayubov"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "daptin", "product": "daptin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "v0.12.34"}], "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "CVE Reserved"}, {"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "Public Disclosure"}], "datePublic": "2026-08-10T10:32:53.000Z", "references": [{"url": "https://github.com/daptin/daptin", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/daptin/daptin/blob/master/server/permission/permission.go", "name": "Vulnerable File", "tags": ["technical-description"]}], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference \u2014 unlike CanExecute, which explicitly guards it.", "supportingMedia": [{"type": "text/html", "value": "<p>An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference \u2014 unlike CanExecute, which explicitly guards it.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:50.994Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72575", "state": "PUBLISHED", "dateUpdated": "2026-08-10T18:22:43.886Z", "dateReserved": "2026-08-10T10:32:53.854Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-10T10:41:00.708Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "daptin", "vendor": "daptin", "versions": [{"lessThanOrEqual": "v0.12.34", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference \u2014 unlike CanExecute, which explicitly guards it."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n impropia en daptin hasta la v0.12.34 permite a atacantes remotos no autenticados leer, crear, actualizar y eliminar registros de grupos de usuarios. Las funciones de verificaci\u00f3n de permisos (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) en servidor/permission/permission.go devuelven verdadero siempre que p.UserId sea igual al userId solicitante, pero no logran rechazar la referencia nula/cero - a diferencia de CanExecute, que la protege expl\u00edcitamente."}], "id": "CVE-2026-72575", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72575", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T15:52:21.769337Z", "version": "2.0.3"}}]}, "published": "2026-08-10T11:17:30.277", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/daptin/daptin"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/daptin/daptin/blob/master/server/permission/permission.go"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.12.34]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "daptin", "source": "cna", "vendor": "daptin"}, "product": "daptin", "vendor": "daptin"}], "created": "2026-08-10T12:30:07.126019+00:00", "updated": "2026-08-10T20:00:04.000585+00:00", "vendors": ["daptin", "daptin$PRODUCT$daptin"]}