Loading story…
A critical improper authorization flaw tracked as CVE-2026-72575 affects Daptin through v0.12.34, allowing unauthenticated remote attackers to read, create, update, and delete usergroup objects. The bug stems from permission-check logic in Daptin's authorization code that returns true when both the stored owner UserId and the requester's UserId are null, effectively treating guest sessions as authorized owners for records loaded without a user association.
The vulnerable behavior impacts usergroup rows because they are loaded with a null owner and no user_account_id, enabling full CRUD access without credentials. The issue is classified as CWE-284 and carries a CVSS 9.1 score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Daptin's repository shows recent work to harden authentication, and defenders are advised to upgrade to a version later than v0.12.34 and enforce authorization checks that reject null or zero-valued user references.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry was published for a critical improper authorization flaw in Daptin through v0.12.34 that lets unauthenticated attackers read, create, update, and delete usergroup records via null owner permission checks in server/permission/permission.go. The entry assigns CVSS 9.1 and recommends updating to a version after v0.12.34 with stricter null-user validation.
The Daptin repository shows the latest commit affecting server/permission/permission.go with the message "harden distributed OTP authentication." This is the only explicitly dated code change referenced in the materials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability, **`CVE-2026-54061`**, affects Dgraph Alpha versions earlier than **`25.3.5`** and allows unauthenticated attackers to reach external snapshot import RPCs exposed on the public gRPC port **`9080`**. The flaw is an authentication bypass (**`CWE-306`**) in which a remote client can send Badger stream data to a target group store without authentication or authorization, enabling direct tampering with database contents over the network. Because the receiving process calls `Prepare()` before processing the imported stream, successful exploitation can delete and replace existing database data, creating high integrity and availability risk. The issue carries a **CVSS v3.1** score vector of **`AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`**, and the CVE record indicates proof-of-concept and automatable exploitation with total technical impact. Dgraph addressed the issue in **version `25.3.5`**, which organizations should treat as the fixed release for exposed Alpha deployments.
Jul 9, 2026
A **critical CrushFTP zero-day**, tracked as `CVE-2025-54309`, has been reported as **actively exploited in the wild**, prompting urgent warnings from security researchers and national incident responders. The flaw affects **CrushFTP 11.x and 10.x** builds including **11.3.4_23 and later** and **10.8.5 and later**, and can allow attackers to **bypass authentication and obtain administrator access over HTTPS** when the **DMZ proxy service is disabled**. The issue has been assigned a **CVSS 3.1 score of 9.0** and has been linked to **improper AS2 validation** in vulnerable versions. CrushFTP released fixes in **11.3.4_26** and **10.8.5_12**, and defenders were urged to patch immediately or restore the application’s original configuration from **clean backups created on or before July 16** if patching is not yet possible. Reported indicators of compromise include changes to `MainUsers/default/user.xml` containing the string `last_logins`, creation of unknown administrator accounts with long identifiers, unusual UI behavior, administrator logins from unfamiliar IP addresses, and altered permissions on sensitive directories.
Jul 24, 2026
A critical CrushFTP authentication bypass flaw, initially tracked as `CVE-2025-2825` and later re-tracked as `CVE-2025-31161`, allows unauthenticated remote attackers to log in as valid users by sending a crafted S3-compatible `Authorization` header. The bug affects versions `10.0.0–10.8.3` and `11.0.0–11.3.0`, and stems from flawed authentication logic in `loginCheckHeaderAuth()` that can skip password verification when processing AWS4-HMAC-style credentials. Researchers reported that an attacker may need only a username in the `Credential` field and a syntactically valid `CrushAuth` cookie format, without successful signature validation, to gain unauthorized access. Security teams reported active exploitation against internet-exposed CrushFTP servers, with Shadowserver observing dozens of attack attempts in the wild. CrushFTP addressed the issue in `10.8.4` and `11.3.1`, including changes to properly validate passwords and a default-disabled setting to block the vulnerable path; defenders were urged to upgrade immediately, restrict external access, or enable DMZ mode where patching is not yet possible. ProjectDiscovery also released a Nuclei detection template that checks for successful user-list retrieval via the bypass, underscoring the need to identify exposed and vulnerable instances quickly.
Aug 15, 2026