CVE-2026-54322

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the target role by its identifier alone, without verifying the role belonged to that organization. An authenticated user who owns any organization (organizations are self-service) could therefore modify the permissions of, or delete, a role belonging to a different organization, given that role's identifier. This vulnerability is fixed in 0.185.0.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/daytonaio/daytona/security/advisories/GHSA-qxvm-pcfm-qc39

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Daytona es un tiempo de ejecución de infraestructura seguro y elástico para la ejecución de código generado por IA y flujos de trabajo de agentes. Antes de la versión 0.185.0, los puntos finales de actualización y eliminación de roles de organización de Daytona autorizaban al llamador como propietario de la organización nombrada en la ruta de la solicitud, pero resolvían y mutaban el rol objetivo solo por su identificador, sin verificar que el rol perteneciera a esa organización. Un usuario autenticado que posee cualquier organización (las organizaciones son de autoservicio) podría, por lo tanto, modificar los permisos de, o eliminar, un rol perteneciente a una organización diferente, dado el identificador de ese rol. Esta vulnerabilidad está corregida en la versión 0.185.0.

Information

Published : 2026-06-23 19:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-54322

Mitre link : CVE-2026-54322

CVE.ORG link : CVE-2026-54322

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

CWE-862

Missing Authorization

{"id": "CVE-2026-54322", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54322", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T18:55:58.656155Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "daytonaio", "product": "daytona", "versions": [{"status": "affected", "version": "< 0.185.0"}]}]}], "published": "2026-06-23T19:17:08.370", "references": [{"url": "https://github.com/daytonaio/daytona/security/advisories/GHSA-qxvm-pcfm-qc39", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the target role by its identifier alone, without verifying the role belonged to that organization. An authenticated user who owns any organization (organizations are self-service) could therefore modify the permissions of, or delete, a role belonging to a different organization, given that role's identifier. This vulnerability is fixed in 0.185.0."}, {"lang": "es", "value": "Daytona es un tiempo de ejecuci\u00f3n de infraestructura seguro y el\u00e1stico para la ejecuci\u00f3n de c\u00f3digo generado por IA y flujos de trabajo de agentes. Antes de la versi\u00f3n 0.185.0, los puntos finales de actualizaci\u00f3n y eliminaci\u00f3n de roles de organizaci\u00f3n de Daytona autorizaban al llamador como propietario de la organizaci\u00f3n nombrada en la ruta de la solicitud, pero resolv\u00edan y mutaban el rol objetivo solo por su identificador, sin verificar que el rol perteneciera a esa organizaci\u00f3n. Un usuario autenticado que posee cualquier organizaci\u00f3n (las organizaciones son de autoservicio) podr\u00eda, por lo tanto, modificar los permisos de, o eliminar, un rol perteneciente a una organizaci\u00f3n diferente, dado el identificador de ese rol. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.185.0."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}