CVE-2026-41422

High

Published: 07/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Daptin is a headless CMS based on GraphQL/JSON-API. In versions prior to 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed without validation, allowing authenticated users to inject arbitrary SQL expressions.

Risk Assessment

The ability for authenticated users to inject SQL poses a serious risk to data security within the organization, potentially leading to unauthorized access or data manipulation.

Recommendation

It is recommended to upgrade Daptin to version 0.11.4 or later to mitigate this vulnerability and implement additional input validation mechanisms.

Other vulnerabilities in Daptin

CVE-2026-72575Critical
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions return true when the user ID matches but fail to reject the null/zero reference, enabling bypass.

Original NVD description (English source)

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.