CVE-2026-72575

The CVE-2026-72575 vulnerability in daptin grants unauthenticated attackers full CRUD access to usergroups through six permission-checking functions that return true when the userId is zero or null. The critical detail is that a seventh function in the same file, CanExecute, correctly guards against this exact condition — explicitly checking for null userId and returning false rather than true. This isn't a case where the developer didn't know about the vulnerability; it's a case where the knowledge existed in one function and never propagated to its siblings. The CVSS 9.1 score is earned — usergroups typically serve as the isolation boundary in multi-tenant APIs, and full access to them can enable privilege escalation through group membership manipulation. But the severity number obscures what matters structurally: the codebase treats authorization validation as a per-function concern rather than a cross-cutting invariant. Six functions were written from the same template, tested with valid userIds, and deployed. CanExecute was either written differently from the start or patched later — the commit history would tell you which — but either way, the knowledge that null userId is a security boundary never became an enforceable pattern across the permission family. For defenders, the practical question isn't whether this specific CVE is patched. It's whether your codebase has authorization logic scattered across multiple files where one function received security hardening while structurally identical siblings did not. Audit your permission-checking functions as a family, not individually. Look for any that accept user context and check permissions without validating that the context is non-null first. The pattern you're looking for is: functions that serve the same purpose, written in the same style, where one happens to have a guard and the others don't. That's the signature of copy-paste security — and it's almost never limited to the six functions you find in the first file you check.

Reviewed through automated stages and approved by a human before publication.