Daytona versions before 0.185.0 have an authorization bypass vulnerability (CWE-639, CWE-862) in the organization role update and delete endpoints. These endpoints authorize the caller based on ownership of the organization named in the request path but resolve the target role solely by its identifier without confirming the role's association with that organization. Consequently, an authenticated user owning any organization can modify or delete roles belonging to other organizations if they know the role identifier. This flaw allows unauthorized privilege modifications or deletions across organizations. The vulnerability has a CVSS 3.1 score of 7.7, indicating high severity, and is fixed in version 0.185.0.

An authenticated user with ownership of any organization can modify permissions or delete roles in other organizations by exploiting the lack of proper authorization checks on role identifiers. This can lead to unauthorized privilege escalation or disruption of role management in organizations they do not own. The impact includes loss of integrity and availability of role configurations across organizations.

Upgrade Daytona to version 0.185.0 or later, where this authorization bypass vulnerability is fixed. There is no indication of alternative mitigations or temporary fixes. Patch status is not explicitly confirmed in the advisory, but the fix is stated to be in 0.185.0, so upgrading to this version or newer is recommended.