The vulnerability occurs in Daptin’s /aggregate/:typename endpoint, where column and group parameters are forwarded directly to the goqu.L() function, a raw SQL literal builder, without validation. An authenticated user can craft inputs that are executed as part of a SQL statement, allowing them to read, modify, or delete data stored in the database. This flaw represents a typical input validation weakness, classified as CWE‑89.

The affected product is Daptin’s headless CMS (GraphQL/JSON‑API). All releases prior to 0.11.4 are vulnerable; the issue was fixed in v0.11.4. Only authenticated users can exploit the flaw, and the attack is performed through the /aggregate/:typename API endpoint.

The CVSS score of 8.3 indicates a high level of severity. While the EPSS score is not available, the absence of a CISA KEV listing does not reduce the likelihood of exploitation, especially since the flaw requires only a valid session. An attacker who gains access to a legitimate session or can hijack one can inject arbitrary SQL statements, potentially compromising confidentiality, integrity, and availability of the underlying database. The primary attack vector is via the exposed HTTP API, which can be accessed over the internet or internally, depending on deployment configuration.