The diboot-core library's POST /common/load-related-data endpoint resolves user-supplied field names to any @TableField column of any entity and returns all rows' values without any allowlist filtering. The relatedDataSecurityCheck() function, which should enforce authorization, unconditionally returns true, allowing any authenticated user to read sensitive fields, including those annotated with @JsonIgnore such as IamAccount.authSecret and IamAccount.secretSalt. These fields contain password hashes protected by Shiro's two-iteration MD5 with an 8-character salt, which is easily crackable offline. Consequently, attackers can recover admin credentials and gain full administrative control. The vulnerability persists in the development branch under the renamed attachMore* mechanism, where attachMoreSecurityCheck() also returns true unconditionally. The official diboot-admin-ui frontend relies on this endpoint, exposing deployments that follow vendor recommendations. No official fix or patch is currently available.

Any authenticated user, even with minimal privileges, can bypass authorization controls to access sensitive secret fields across all entities. This includes admin password hashes that can be cracked offline due to weak hashing, enabling full administrative takeover. The vulnerability compromises confidentiality and potentially leads to complete system compromise without requiring elevated privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint by limiting authenticated user permissions or disabling the endpoint if possible. Review and harden authorization checks on endpoints that expose entity fields. Monitor vendor communications for official patches or updates.