CVE-2026-72575: Daptin Auth Bypass Vulnerability

CVE-2026-72575 Overview

CVE-2026-72575 is an improper authorization vulnerability [CWE-284] in Daptin through version v0.12.34. The flaw allows unauthenticated remote attackers to read, create, update, and delete usergroup records. Permission check functions in server/permission/permission.go return true when p.UserId equals the requesting userId, but fail to reject the null or zero reference. Only CanExecute explicitly guards against this condition. Attackers can exploit this over the network without any user interaction or credentials.

Critical Impact
Unauthenticated remote attackers can fully manipulate usergroup records in Daptin, enabling access control tampering and privilege escalation across the platform.

Affected Products

Daptin through v0.12.34
The server/permission/permission.go module
Deployments exposing Daptin APIs to untrusted networks

Discovery Timeline

2026-08-10 - CVE-2026-72575 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72575

Vulnerability Analysis

Daptin uses a permission subsystem in server/permission/permission.go to authorize object access. The functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, and CanRefer compare the record owner (p.UserId) against the requesting userId. When both values match, the functions return true. The comparison does not distinguish between a legitimate authenticated identifier and the null or zero reference used for unauthenticated requests.

An unauthenticated request arrives with a zero-valued userId. Records lacking an owner also carry a zero-valued p.UserId. The equality check succeeds, and the caller receives full permission on the record. This behavior breaks the intended access control model on usergroup records, which govern membership and downstream authorization.

The CanExecute function guards against this case by explicitly rejecting null or zero references. The remaining permission functions omit this guard, producing an inconsistent authorization surface.

Root Cause

The root cause is missing input validation on the identity value passed into permission checks. The functions rely on equality alone without asserting that the identifier represents an authenticated principal. This produces a broken access control condition mapped to [CWE-284].

Attack Vector

An attacker sends unauthenticated HTTP requests to Daptin API endpoints that operate on usergroup records. Because the permission check accepts the zero identifier, the server processes read, create, update, and delete operations as if authorized. No credentials, tokens, or user interaction are required. The vulnerability is exploitable directly over the network.

See the Daptin permission source code for the affected implementation.

Detection Methods for CVE-2026-72575

Indicators of Compromise

Unauthenticated HTTP requests to Daptin API paths that reference usergroup objects
Unexpected creation, modification, or deletion of usergroup records without a corresponding authenticated session
Access log entries showing requests without an Authorization header succeeding against protected endpoints

Detection Strategies

Inspect Daptin API access logs for privileged operations issued by requests lacking authentication tokens
Correlate usergroup record change events with the identity of the requester and flag entries tied to a zero or null user reference
Deploy signatures on network sensors that identify Daptin API calls targeting usergroup routes from external sources

Monitoring Recommendations

Enable verbose audit logging for all permission decisions inside Daptin
Alert on any state change to usergroup records outside of approved administrative workflows
Monitor for spikes in anonymous requests reaching the Daptin application layer

How to Mitigate CVE-2026-72575

Immediate Actions Required

Restrict network exposure of Daptin instances to trusted administrative networks until a patched build is deployed
Place an authenticating reverse proxy in front of Daptin to reject unauthenticated requests to permission-sensitive endpoints
Audit usergroup records for unauthorized modifications and restore known-good state where required

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the Daptin repository for a fixed release beyond v0.12.34. The corrective change must add a null or zero reference guard to CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, and CanRefer, mirroring the check in CanExecute.

Workarounds

Enforce authentication at a network gateway or service mesh in front of Daptin
Deny anonymous HTTP methods that mutate state through web server or WAF rules
Remove or isolate Daptin from internet-facing segments until an upstream fix is available

bash

# Example nginx rule to block unauthenticated access to Daptin API
location /api/ {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://daptin_backend;
}