Vulnerabilities

TI-2026-83293 CVE-2026-62160

Uncontrolled CPU use in Daptin via Accept-Language header parsing

HIGH 77

Daptin is a GraphQL/JSON-API headless CMS.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00417 Published 2026-10-30 Fixed in 0.12.26 CWE-400

TI-2026-50833 CVE-2026-72575 · GHSA-w34h-746p-3wp3

daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

MEDIUM 48

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00529 Published 2026-08-10 No fix listed CWE-284

TI-2026-32315 CVE-2026-44349 · GHSA-pwqg-q8pg-pp6r

Daptin fuzzy search injects unvalidated column name into raw SQL

HIGH 70

Daptin is a GraphQL/JSON-API headless CMS.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00305 Published 2026-05-07 Fixed in 0.11.5 CWE-89

TI-2026-30021 CVE-2026-41422 · GHSA-rw2c-8rfq-gwfv

Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API

LOW 38

Daptin is a GraphQL/JSON-API headless CMS.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00345 Published 2026-05-07 Fixed in 0.11.4 CWE-89

Vulnerabilities

Filters

Uncontrolled CPU use in Daptin via Accept-Language header parsing

daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects

Daptin fuzzy search injects unvalidated column name into raw SQL

Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API