CVE-2026-112037 Details
Description
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability has been identified in the Diem Project's Google Analytics client, bundled within the 'dmCorePlugin' directory. This flaw, present in versions of Diem through commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, arises from an unknown function in the file 'gapi.class.php'. The issue involves improper validation of TLS certificates, as the cURL extension is commonly available in PHP deployments, allowing the client to authenticate with Google Analytics without verifying the server's identity. This vulnerability can be exploited remotely, but requires a high level of complexity.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/diem-project/diem/ | [email protected] | Vendor |
| https://github.com/diem-project/diem/issues/454 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112037 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1008079 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421685 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421685/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| diem-project diem | 116974edfb9a5b8bd69cb13586dc62bcdbb485ad |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |