Vulnerability-Lookup

CVE-2026-41422 (GCVE-0-2026-41422)

Vulnerability from cvelistv5 – Published: 2026-05-07 13:56 – Updated: 2026-05-07 14:57

Title

Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API

Summary

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.

Severity ?

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/daptin/daptin/security/advisor…	x_refsource_CONFIRM
	https://github.com/daptin/daptin/releases/tag/v0.11.4	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	daptin	daptin	Affected: < 0.11.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41422",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-07T14:55:58.874491Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-07T14:57:04.226Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "daptin",
          "vendor": "daptin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.11.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() \u2014 a raw SQL literal expression builder \u2014 without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T13:56:18.648Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv"
        },
        {
          "name": "https://github.com/daptin/daptin/releases/tag/v0.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/daptin/daptin/releases/tag/v0.11.4"
        }
      ],
      "source": {
        "advisory": "GHSA-rw2c-8rfq-gwfv",
        "discovery": "UNKNOWN"
      },
      "title": "Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41422",
    "datePublished": "2026-05-07T13:56:18.648Z",
    "dateReserved": "2026-04-20T15:32:33.813Z",
    "dateUpdated": "2026-05-07T14:57:04.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-41422",
      "date": "2026-05-08",
      "epss": "0.00046",
      "percentile": "0.14092"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-41422\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-07T15:16:06.813\",\"lastModified\":\"2026-05-07T15:47:46.853\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() \u2014 a raw SQL literal expression builder \u2014 without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":8.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":5.5}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://github.com/daptin/daptin/releases/tag/v0.11.4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-41422\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-07T14:55:58.874491Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-07T14:56:04.834Z\"}}], \"cna\": {\"title\": \"Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API\", \"source\": {\"advisory\": \"GHSA-rw2c-8rfq-gwfv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"daptin\", \"product\": \"daptin\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.11.4\"}]}], \"references\": [{\"url\": \"https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv\", \"name\": \"https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/daptin/daptin/releases/tag/v0.11.4\", \"name\": \"https://github.com/daptin/daptin/releases/tag/v0.11.4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() \\u2014 a raw SQL literal expression builder \\u2014 without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-07T13:56:18.648Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-41422\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-07T14:57:04.226Z\", \"dateReserved\": \"2026-04-20T15:32:33.813Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-07T13:56:18.648Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-41422

Vulnerability from fkie_nvd - Published: 2026-05-07 15:16 - Updated: 2026-05-07 15:47

Severity ?

8.3 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/daptin/daptin/releases/tag/v0.11.4
	security-advisories@github.com	https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() \u2014 a raw SQL literal expression builder \u2014 without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions. This issue has been patched in version 0.11.4."
    }
  ],
  "id": "CVE-2026-41422",
  "lastModified": "2026-05-07T15:47:46.853",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-07T15:16:06.813",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/daptin/daptin/releases/tag/v0.11.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-RW2C-8RFQ-GWFV

Vulnerability from github – Published: 2026-04-22 17:38 – Updated: 2026-04-22 17:38

Summary

Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API

Details

Summary

The /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L() — a raw SQL literal expression builder — without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions.

Impact

An authenticated low-privilege user could: - Extract data from any table via subquery: (SELECT group_concat(email) FROM user_account) as leak - Disclose database internals: sqlite_version(), (SELECT sql FROM sqlite_master) - Exfiltrate cross-table data via correlated subqueries

The vulnerability was confirmed locally; user_account.email values were extracted via a crafted column parameter by a non-admin user.

Root Cause

goqu.L(userInput) in server/resource/resource_aggregate.go inserted user-supplied query parameters directly into the SQL string with no validation.

Fix (v0.11.4)

All goqu.L() calls on user-controlled input were eliminated and replaced with: - Structural expression parsing supporting all documented API forms - Schema-based column validation (column names checked against entity schema via TableInfo().GetColumnByName()) - Exact-match allowlist for aggregate functions (count, sum, avg, min, max, first, last) and scalar functions (date, strftime, upper, lower, etc.) - Safe goqu constructors (goqu.I(), goqu.SUM(), goqu.Func()) for all generated expressions - allowedTables scope enforcement: qualified column refs (table.col) validated against root entity + explicitly joined tables only

Two additional DoS bugs were fixed in the same commit: uuid.MustParse panic on malformed UUID input and an index-out-of-range panic in ToOrderedExpressionArray on empty sort expressions.

Credits

Reported by @VashuVats.

Severity ?

8.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/daptin/daptin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41422"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-22T17:38:02Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `/aggregate/:typename` endpoint accepted `column` and `group` query parameters that were passed verbatim to `goqu.L()` \u2014 a raw SQL literal expression builder \u2014 without any validation. This bypassed all parameterization and allowed authenticated users with any valid session to inject arbitrary SQL expressions.\n\n## Impact\n\nAn authenticated low-privilege user could:\n- Extract data from any table via subquery: `(SELECT group_concat(email) FROM user_account) as leak`\n- Disclose database internals: `sqlite_version()`, `(SELECT sql FROM sqlite_master)`\n- Exfiltrate cross-table data via correlated subqueries\n\nThe vulnerability was confirmed locally; `user_account.email` values were extracted via a crafted `column` parameter by a non-admin user.\n\n## Root Cause\n\n`goqu.L(userInput)` in `server/resource/resource_aggregate.go` inserted user-supplied query parameters directly into the SQL string with no validation.\n\n## Fix (v0.11.4)\n\nAll `goqu.L()` calls on user-controlled input were eliminated and replaced with:\n- Structural expression parsing supporting all documented API forms\n- Schema-based column validation (column names checked against entity schema via `TableInfo().GetColumnByName()`)\n- Exact-match allowlist for aggregate functions (`count`, `sum`, `avg`, `min`, `max`, `first`, `last`) and scalar functions (`date`, `strftime`, `upper`, `lower`, etc.)\n- Safe goqu constructors (`goqu.I()`, `goqu.SUM()`, `goqu.Func()`) for all generated expressions\n- `allowedTables` scope enforcement: qualified column refs (`table.col`) validated against root entity + explicitly joined tables only\n\nTwo additional DoS bugs were fixed in the same commit: `uuid.MustParse` panic on malformed UUID input and an index-out-of-range panic in `ToOrderedExpressionArray` on empty sort expressions.\n\n## Credits\n\nReported by @VashuVats.",
  "id": "GHSA-rw2c-8rfq-gwfv",
  "modified": "2026-04-22T17:38:02Z",
  "published": "2026-04-22T17:38:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/daptin/daptin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/daptin/daptin/releases/tag/v0.11.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-41422 (GCVE-0-2026-41422)

FKIE_CVE-2026-41422

GHSA-RW2C-8RFQ-GWFV

Summary

Impact

Root Cause

Fix (v0.11.4)

Credits

Tags

Sightings

Nomenclature