PT-2026-68781

Name of the Vulnerable Software and Affected Versions diboot-core affected versions not specified Description The POST '/common/load-related-data' endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows without a field or entity...

CVE-2026-70557: Authorization Bypass Through User-Controlled Key

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...