A SQL injection vulnerability exists in Daptin's /aggregate/:typename API endpoint where user-supplied column and group parameters are passed directly to goqu.L() without validation. This allows authenticated users with any valid session to inject arbitrary SQL expressions. The flaw enables data extraction from any table, disclosure of database internals, and cross-table data exfiltration. The issue is fixed in version 0.11.4 by removing unsafe goqu.L() calls and adding strict schema validation and allowlists for functions.