Threats tagged 'ghsa-5cj8-jrqq-crmv'

diboot-core contains an authorization bypass vulnerability in its POST /common/load-related-data endpoint. This endpoint allows any authenticated user, including those with minimal privileges, to read sensitive fields from any entity without proper access control. The vulnerability arises because the security check always returns true, exposing secret fields such as admin password hashes. These hashes use a weak MD5-based scheme that can be cracked offline, potentially leading to full administrative takeover. The vulnerable endpoint is used by the official diboot-admin-ui frontend, making this a significant risk in standard deployments.