An improper authorization flaw exists in daptin version 0.12.34 that enables remote attackers who do not authenticate to perform full CRUD operations on usergroup records. The flaw lies in the permission functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) located in server/permission/permission.go, which grant access whenever the request’s UserId matches the record’s p.UserId, yet they do not reject a null or zero owner reference. Because usergroup objects can be created with a null owner, the lack of validation allows the attacker to bypass ownership checks, effectively obtaining unrestricted access to all usergroup entries.

daptin, version 0.12.34 and earlier – the vulnerability exists in the server/permission/permission.go module of the open-source application available on the daptin GitHub repository.

The CVSS score of 9.1 classifies this flaw as critical, indicating the potential for complete loss of data integrity and confidentiality. The EPSS score is not reported, but the absence of a listed KEV status does not reduce the risk. The vulnerability allows unauthenticated remote attackers to trigger the flaw simply by sending HTTP requests to the usergroup API. Because the permission checks incorrectly return true when the request’s UserId equals the record’s owner ID, and they do not reject a null or zero owner reference, an attacker with a null or unauthenticated UserId can bypass ownership verification and gain full CRUD access. The likely attack vector is remote, through any exposed API endpoint that handles usergroup data, and the risk is high due to the critical severity and the availability of the flaw.