Read the docs
TI-2026-32315 Aliases CVE-2026-44349GHSA-pwqg-q8pg-pp6r

Daptin fuzzy search injects unvalidated column name into raw SQL

Priority HIGH 70CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.L(fmt.Sprintf("LOWER(%s) LIKE ?", prefix+col)) raw SQL with no column whitelist check. The entry point is GET /api/<entity> with operator=fuzzy (or fuzzy_any, fuzzy_all). Any authenticated user — including one who self-registered with no admin involvement — can read the entire database. This issue has been patched in version 0.11.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Fixed daptin (daptin): 0.11.5github.com/daptin/daptin (Go): 0.11.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
daptindaptinbefore 0.11.50.11.5Patch availableCNA
—github.com/daptin/daptin (Go)before 0.11.50.11.5Patch availableGHSA-pwqg-q8pg-pp6r
  • daptin Vendordaptin Affected before 0.11.5 Fixed in 0.11.5 Patch available CNA
  • github.com/daptin/daptin (Go) Vendor— Affected before 0.11.5 Fixed in 0.11.5 Patch available GHSA-pwqg-q8pg-pp6r

Remediation

  • Fix · CNA daptin (daptin) Fixed in 0.11.5
  • Fix · GHSA-pwqg-q8pg-pp6r github.com/daptin/daptin (Go) Fixed in 0.11.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44349
  2. 2026-10-03 Alias added: GHSA-pwqg-q8pg-pp6r

References

Advisory 1

Other 3

  • TI-2026-83293 Uncontrolled CPU use in Daptin via Accept-Language header parsing CVSS 4.0HIGH 8.7
  • TI-2026-50833 daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects CVSS 3.1CRITICAL 9.1
  • TI-2026-30021 Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API CVSS 3.1HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences