The diboot-core library's POST /common/load-related-data endpoint resolves user-supplied field names to any @TableField column of any entity and returns all rows' values without enforcing an allowlist on fields or entities. The relatedDataSecurityCheck() function, intended to guard access, unconditionally returns true, allowing any authenticated user to access sensitive fields, including those annotated with @JsonIgnore such as IamAccount.authSecret and IamAccount.secretSalt. These fields contain admin password hashes protected by a weak two-iteration MD5 with an 8-character salt, which is easily crackable offline. The vulnerability enables attackers to obtain password hashes that can lead to full administrative account compromise. The official diboot-admin-ui frontend relies on this endpoint, so deployments following vendor recommendations are exposed. The mechanism was renamed in development but remains unprotected.

Any authenticated user, even with minimal privileges, can access sensitive secret fields from all accounts and entities, including admin password hashes. Because the password hashing scheme is weak and crackable offline, attackers can potentially recover admin credentials and achieve full administrative control over the system. This represents a significant confidentiality breach and privilege escalation risk. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint or disable the diboot-admin-ui frontend that relies on it. Monitor vendor communications for updates and apply official patches once released. Avoid exposing this endpoint to untrusted users.