CVE-2026-70557

Received Received - Intake

diboot-core Unauthenticated Data Exposure Leads to Admin Takeover

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck(), returns true unconditionally, so any authenticated user (including a zero-role account) can read @JsonIgnore-annotated secret fields such as IamAccount.authSecret and IamAccount.secretSalt for every account, or arbitrary secret fields of any other entity. Shiro's two-iteration MD5 with an 8-character salt is trivially crackable offline, so the disclosed admin password hashes convert to full administrative takeover. The endpoint is not example code; the official diboot-admin-ui frontend requires it, so deployments following the vendor's recommended integration expose it. The mechanism was renamed relatedData* to attachMore* on the development branch, but attachMoreSecurityCheck() also returns true unconditionally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-70557

Affected Vendors & Products

Vendor	Product	Version / Range
diboot	diboot-core	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in diboot-core allows authenticated users to read sensitive fields like admin password hashes and secret salts from any entity due to improper field and entity allowlisting. The endpoint resolves caller-supplied field names to any column, bypassing security checks that return true unconditionally.

Detection Guidance

Check for unauthorized access to the /common/load-related-data endpoint in diboot-core. Monitor logs for requests to this endpoint with unusual field names or excessive data retrieval. Verify if any user accounts have accessed secret fields like IamAccount.authSecret or IamAccount.secretSalt.

Impact Analysis

An attacker can exploit this to read sensitive data like admin password hashes and secret salts, then crack weak MD5 hashes to gain full administrative access. Even low-privilege users can access this data if the endpoint is exposed.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (privacy) by exposing sensitive personal or health data. Unauthorized access to admin credentials and secret fields could lead to compliance breaches and legal penalties.

Mitigation Strategies

Disable or restrict access to the /common/load-related-data endpoint. Update to a patched version of diboot-core where relatedDataSecurityCheck() or attachMoreSecurityCheck() enforces proper field and entity allowlists. Rotate all admin passwords immediately due to the crackable MD5 hashes.

Hi! I’m here to help you understand CVE-2026-70557. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70