CVE-2026-72575: daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72575?
The severity of CVE-2026-72575 is rated as critical with a score of 9.1.
How do I fix CVE-2026-72575?
To fix CVE-2026-72575, update to the latest patched version of daptin that addresses the authentication bypass vulnerability.
What does CVE-2026-72575 allow attackers to do?
CVE-2026-72575 allows unauthenticated remote attackers to read, create, update, and delete usergroup records.
In which version of daptin is CVE-2026-72575 present?
CVE-2026-72575 is present in daptin versions up to and including v0.12.34.
What types of records are affected by CVE-2026-72575?
CVE-2026-72575 affects usergroup records in the daptin application.