The vulnerability in daptin through version 0.12.34 is due to improper authorization checks in the permission functions (CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer) located in server/permission/permission.go. These functions incorrectly return true when the permission's UserId matches the requesting userId but do not properly reject null or zero userId references. This flaw allows unauthenticated remote attackers to perform unauthorized operations on usergroup records, including reading, creating, updating, and deleting them. The CanExecute function correctly guards against null references, highlighting inconsistent authorization logic.

Unauthenticated remote attackers can bypass authorization controls to fully manipulate usergroup records, leading to unauthorized disclosure, modification, and creation of sensitive data. This compromises confidentiality and integrity but does not affect availability. The critical CVSS score of 9.1 reflects the high impact on confidentiality and integrity with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected daptin service to trusted users only and monitor for suspicious activity related to usergroup management. Avoid exposing the service to untrusted networks.