{"id":"GO-2026-5600","revision":"919ce5be9267408a934937b26282067f","records":[{"revision":"919ce5be9267408a934937b26282067f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5600","aliases":["CVE-2026-54322","GHSA-qxvm-pcfm-qc39"],"title":"Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles in github.com/daytonaio/daytona","description":"Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles in github.com/daytonaio/daytona","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:23.1648819+00:00","affected":[{"ecosystem":"Go","name":"github.com/daytonaio/daytona","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.185.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/daytonaio/daytona/security/advisories/GHSA-qxvm-pcfm-qc39"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5600","license":"OSV · upstream source license applies","key":"osv:GO-2026-5600","identifiers":["GO-2026-5600","CVE-2026-54322","GHSA-qxvm-pcfm-qc39"]},"retained":false,"historicalAffected":[]}],"coverage":[]}