Daptin vulnerabilities
We track 4 vulnerabilities in Daptin products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Daptin vulnerabilities
- 8.7 High severity
daptin: Uncontrolled Resource Consumption
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAccep
- 9.1 Critical severity
daptin: Improper Access Control
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) in se
- 7.1 High severity
daptin: Improper Neutralization of Special Elements used in an SQL Command
Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.L(fmt.Sprintf("LOWER
- 8.3 High severity
daptin: Improper Neutralization of Special Elements used in an SQL Command
Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypasse