The vulnerability arises from an improper authorization check in daptin version 0.12.34, where permission functions such as CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, and CanRefer incorrectly return true when the requesting userId matches the record's userId but fail to guard against a null or zero owner reference. Because usergroup table rows lack a user_account_id and are loaded with a null owner, any request with a null UserId grants full CRUD access to all usergroup objects. This constitutes an authentication bypass that can be exploited by remote attackers without prior login, leading to unauthorized data manipulation and potential privilege escalation within the application.

daptin, version 0.12.34 and earlier – the vulnerability exists in the server/permission/permission.go module of the open-source application available on the daptin GitHub repository.

The CVSS score of 9.1 classifies this flaw as critical, indicating the potential for complete loss of data integrity and confidentiality. The EPSS score is not reported, but the absence of a listed KEV status does not reduce the risk, as the flaw allows unauthenticated remote exploitation. Attackers can trigger the flaw simply by sending remote HTTP requests to the usergroup API with no authentication; the lack of a valid owner in usergroup records provides a direct attack path. The likely attack vector is remote, through any exposed API endpoint that handles usergroup data, and the risk is high due to the critical severity and the availability of the flaw.