CVE-2026-72575 daptin CVE debrief

Who should care

Organizations using daptin, especially those with exposed instances or deployments that may be accessible to unauthorized parties, should prioritize addressing this vulnerability. This includes reviewing their inventory of daptin installations, assessing the potential impact of this vulnerability, and implementing compensating controls to restrict access to usergroup records until a vendor remediation is available. Security teams and vulnerability management teams should also be aware of the potential risks associated with this vulnerability and plan accordingly. Additionally, operators and platform administrators should verify their configurations and ensure that appropriate mitigations are in place to prevent exploitation. This vulnerability could have significant operational impacts if exploited, making it crucial for affected organizations to take immediate action. The vulnerability's high CVSS score of 9.1 and CRITICAL severity rating underscore the urgency of this issue. Organizations should also monitor for suspicious activity related to usergroup record manipulation and be prepared to apply vendor remediation as soon as it becomes available. Effective communication and coordination between security, IT, and development teams are essential to address this vulnerability promptly and effectively. By taking proactive steps, organizations can minimize the risk of exploitation and protect their assets from potential harm. It's also important for organizations to review and update their incident response plans to include procedures for handling potential exploitation of this vulnerability. This will help ensure a swift and effective response in the event of an attack. Overall, a comprehensive approach that includes assessment, mitigation, and ongoing monitoring is necessary to manage the risks associated with CVE-2026-72575 effectively. This approach should be tailored to the specific needs and configurations of each organization using daptin. By prioritizing this vulnerability and taking prompt action, organizations can reduce their exposure to potential attacks and protect their critical assets. The vulnerability's impact on an organization's security posture

Technical summary

The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it. This oversight allows unauthenticated remote attackers to manipulate usergroup records. The affected product is daptin through version 0.12.34.

Defensive priority

Organizations using daptin should verify their inventory and assess the potential impact of this vulnerability.

Recommended defensive actions

• Verify inventory of daptin installations
• Assess potential impact of the vulnerability
• Implement compensating controls to restrict access to usergroup records
• Monitor for suspicious activity related to usergroup record manipulation
• Apply vendor remediation when available

Evidence notes

The CVE description indicates an improper authorization vulnerability in daptin through v0.12.34, allowing unauthenticated remote attackers to read, create, update, and delete usergroup records due to flawed permission check functions.

Official resources