CVE-2026-112029 Details
Description
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in the Diem content management framework, specifically in versions up to 5.1.3. The issue is located in the SHA1 Handler component, within the file 'lib/model/doctrine/PluginDmUser.class.php'. The vulnerability arises because user passwords are hashed using a single-round SHA-1 algorithm, which is fast and lacks sufficient computational effort to resist cracking. This flaw allows for efficient offline password recovery, especially if the password hash dataset is accessible. The vulnerability requires local exploitation and has been publicly disclosed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/diem-project/diem/ | [email protected] | Vendor |
| https://github.com/diem-project/diem/issues/452 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112029 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1008077 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421677 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421677/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-326 | Inadequate Encryption Strength | [email protected] |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| diem-project diem | <= 5.1.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |