CVE-2026-70557

Name of the Vulnerable Software and Affected Versions diboot-core (affected versions not specified)

Description The POST '/common/load-related-data' endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows without a field or entity allowlist. The security guard function relatedDataSecurityCheck() returns true unconditionally, allowing any authenticated user, including those with zero roles, to read secret fields annotated with @JsonIgnore, such as IamAccount.authSecret and IamAccount.secretSalt for all accounts, or other arbitrary secret fields. Because the system uses Shiro's two-iteration MD5 with an 8-character salt, which is easily crackable offline, the disclosure of admin password hashes can lead to full administrative takeover. This endpoint is required by the official diboot-admin-ui frontend. On the development branch, this mechanism was renamed to attachMore*, but the attachMoreSecurityCheck() function also returns true unconditionally.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.