Daptin’s fuzzy search feature performed an unchecked split of a user‑supplied column name and concatenated each part directly into a raw SQL statement. This allowed an attacker to inject arbitrary column references, resulting in full database visibility for anyone who could authenticate to the system. The vulnerability is a classic SQL injection (CWE‑89), with a moderate‑to‑high impact due to the ability to exfiltrate all database contents.

The flaw exists in Daptin’s headless CMS, affecting all releases prior to version 0.11.5. Users of any entity type when calling the GET /api/<entity> endpoint with operator parameters such as fuzzy, fuzzy_any, or fuzzy_all are susceptible.

The CVSS base score of 7.1 denotes significant severity. Attackers must first authenticate, which is typically low effort via self‑registration, and then invoke the vulnerable operator. There is no external exploit required, and the issue is not listed in the CISA KEV catalog. Because the attack vector is a simple authenticated HTTP request, the risk of exploitation in actively maintained installations is moderate, warranting prompt remediation.