CVE-2026-41422
HighSummary
Daptin is a headless CMS based on GraphQL/JSON-API. In versions prior to 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed without validation, allowing authenticated users to inject arbitrary SQL expressions.
Risk Assessment
The ability for authenticated users to inject SQL poses a serious risk to data security within the organization, potentially leading to unauthorized access or data manipulation.
Recommendation
It is recommended to upgrade Daptin to version 0.11.4 or later to mitigate this vulnerability and implement additional input validation mechanisms.
Other vulnerabilities in Daptin
See all- CVE-2026-72575Critical
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions return true when the user ID matches but fail to reject the null/zero reference, enabling bypass.
- CVE-2026-62160High
In Daptin (a GraphQL/JSON-API headless CMS) before 0.12.26, the global LanguageMiddleware passes the raw Accept-Language header to golang.org/x/text without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, so long lists of underscore-separated language subtags bypass it and cause quadratic buffer processing. Unauthenticated requests to the public landing page or /api can exhaust server CPU.
- CVE-2025-15439Medium
In Daptin 0.10.3, the goqu.L function in server/resource/resource_aggregate.go of the Aggregate API component is vulnerable to SQL injection via manipulation of the column/group/order arguments. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS