CyberRota Analysis
AI-GeneratedAn improper authorization vulnerability in daptin allows unauthenticated remote attackers to gain full CRUD access to usergroup records due to insufficient permission checks. This critical flaw could lead to unauthorized data manipulation and exposure, making it imperative for organizations using daptin to prioritize immediate remediation. All users of daptin, particularly those managing sensitive usergroup data, should address this vulnerability without delay.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in server/permission/permission.go return true whenever p.UserId equals the requesting userId, but fail to reject the null/zero reference — unlike CanExecute, which explicitly guards it.