CVE-2026-112037
LowCVSS 3.7Summary
A flaw in the Google Analytics Client component of diem-project diem causes improper certificate validation. Data manipulation can lead to acceptance of an invalid certificate, and the attack may be launched remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
Improper certificate validation may allow an attacker to impersonate a trusted service and intercept or modify data transmitted by the application. Given the publicly available exploit, the risk of exploitation is real.
Recommendation
Update diem-project diem to the latest patched version or enforce proper certificate validation in the Google Analytics client as a workaround. Monitor the project for an official fix, as the issue report has not yet been addressed.
Other vulnerabilities in diem-project diem
See all- CVE-2026-112030Medium
A vulnerability was found in diem-project diem up to 5.1.3 affecting the file dmCorePlugin/lib/data/dmDataLoad.php. Manipulation leads to use of default password, and the attack can be carried out remotely. The exploit has been made public and could be used.
- CVE-2026-112029Low
In diem-project diem, in file lib/model/doctrine/PluginDmUser.class.php (SHA1 Handler component), manipulation of the salt/password argument leads to password hashes with insufficient computational effort. The attack requires local access and high complexity, and the exploit has been publicly disclosed.
Original NVD description (English source)
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS