CVE-2026-72575

Name of the Vulnerable Software and Affected Versions daptin versions prior to 0.12.35

Description An improper authorization issue allows unauthenticated remote attackers to perform read, create, update, and delete operations on usergroup records. The flaw exists in the server/permission/permission.go file within the permission check functions CanRead(), CanPeek(), CanCreate(), CanUpdate(), CanDelete(), and CanRefer(). These functions return true when the p.UserId matches the requesting userId but fail to reject null or zero references. Because usergroup table rows lack a user account id and are loaded with a null owner, an unauthenticated guest with a null session UserId is granted full CRUD (Create, Read, Update, Delete) access to all usergroup objects.

Recommendations Update daptin to version 0.12.35 or later.