CVE-2026-112037
Received Received - Intake

Improper Certificate Validation in Diem Google Analytics Client

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112037
EUVD
EUVD-2026-104032

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a bundled Google Analytics client in the Diem project that disables TLS certificate validation during authentication. The cURL transport unconditionally sets CURLOPT_SSL_VERIFYPEER to false, disabling peer verification when authenticating with Google Analytics using credentials. This allows attackers in a man-in-the-middle position to impersonate the Analytics endpoint, steal credentials, and manipulate reporting data.

Detection Guidance

Check the file dmCorePlugin/lib/vendor/gapi/gapi.class.php for the presence of CURLOPT_SSL_VERIFYPEER set to false. Search for the string in PHP files using grep -r "CURLOPT_SSL_VERIFYPEER" /path/to/diem-project/. Also inspect dmAdminPlugin/modules/dmGoogleAnalytics/lib/dmGoogleAnalyticsForm.php for similar settings.

Monitor network traffic for unencrypted or suspicious connections to Google Analytics endpoints during authentication attempts. Use tools like Wireshark or tcpdump to capture traffic and look for certificate validation bypasses.

Impact Analysis

An attacker could intercept credentials when an administrator submits them, steal data, or alter reporting information. The impact requires the attacker to be in a network position to intercept traffic and for an administrator to submit credentials.

Compliance Impact

This vulnerability disables TLS certificate validation during authentication with Google Analytics, allowing man-in-the-middle attacks. This could lead to credential theft and data manipulation, which may violate GDPR requirements for secure data transmission and HIPAA requirements for protecting sensitive health information during transmission.

Mitigation Strategies

Immediately update the Diem project to the latest version if available. If not, manually edit the affected files to set CURLOPT_SSL_VERIFYPEER to true in gapi.class.php and dmGoogleAnalyticsForm.php.

Disable the Google Analytics plugin if not essential. Rotate any exposed credentials used for Google Analytics authentication. Implement network monitoring to detect man-in-the-middle attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart