The vulnerability in Daytona's notification WebSocket gateway allows an authenticated user to subscribe to another organization's realtime notification channel by supplying an arbitrary organizationId during the WebSocket join request, resulting in passive exposure of that organization's events and compromising confidentiality. The flaw arises from the gateway’s failure to verify the organizationId, and it does not provide escalation to execute code or disrupt service. This issue matches CWE-639 (Authorization Bypass Through User‑Controlled Key) and CWE-863 (Insecure Direct Object Reference).

This issue affects the Daytona platform from daytonaio, impacting all versions released prior to 0.185.0. No other vendors or product lines are listed.

The CVSS score of 6.5 denotes moderate severity, reflecting that the flaw can leak confidential data but does not enable further exploitation. EPSS is unavailable, so the likelihood of immediate exploitation remains uncertain, and the vulnerability is not in the CISA KEV catalog. An attacker would need to be an authenticated Daytona user and manipulate the WebSocket join parameters, accepting that the current implementation does not validate the organizationId properly.