{"data":{"id":"2baad874-5ba2-4d8c-b943-fcd7d8808087","title":"CVE-2026-54320: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to…","summary":"CVE-2026-54320 affects Daytona, an infrastructure runtime for AI-generated code execution and agent workflows, prior to 0.184.0. The organization invitation accept and decline paths did not require the matching email to be verified, although organization creation did. On identity providers that allow self-service signup and issue a session before email verification, an actor could register an unverified address matching a pending invitation, accept it, and join the target organization with the invitation's role, up to Owner.","solution":"Fixed in 0.184.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54320","publishedAt":"2026-06-23T19:17:07.993Z","cveId":"CVE-2026-54320","cweIds":["CWE-287","CWE-863"],"cvssScore":"8.4","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Daytona"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Daytona organization invitation acceptance without verified email","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00352,"epssCheckedAt":"2026-11-09T12:10:43.918Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T00:09:37.864Z","patchAvailable":null,"disclosureDate":"2026-06-23T19:17:07.993Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-114","CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}