Daptin
Monthly
Improper authorization in Daptin through v0.12.34 lets unauthenticated remote guests perform full CRUD (read, create, update, delete) on all usergroup records, effectively bypassing access control on the platform's group and permission objects. The flaw arises because permission checks treat a null/zero UserId as a valid ownership match, so a guest whose session UserId is null is granted owner-level rights over ownerless usergroup rows. No public exploit identified at time of analysis, but the CVSS of 9.1 (network, no auth, no interaction) reflects that manipulating usergroups can be leveraged to escalate privileges and corrupt the platform's authorization model.
Improper authorization in Daptin through v0.12.34 lets unauthenticated remote guests perform full CRUD (read, create, update, delete) on all usergroup records, effectively bypassing access control on the platform's group and permission objects. The flaw arises because permission checks treat a null/zero UserId as a valid ownership match, so a guest whose session UserId is null is granted owner-level rights over ownerless usergroup rows. No public exploit identified at time of analysis, but the CVSS of 9.1 (network, no auth, no interaction) reflects that manipulating usergroups can be leveraged to escalate privileges and corrupt the platform's authorization model.