Diem CMS CVE-2026-112029

Exploitation requires that the attacker already possess the stored SHA1 password hashes generated by the PluginDmUser SHA1 Handler - i.e., prior local access to the Diem host or its user database (reflected by AV:L and PR:L). The weakness does not grant any remote or unauthenticated foothold; it only accelerates offline password recovery once hashes are in hand. Limiting factors per the CVSS vector and description: local access only, high attack complexity, low-privilege prerequisite, and impact limited to confidentiality of credentials (no integrity/availability effect). Strong, unique per-user passwords and separate salting reduce practical crackability even with the weak hash. Applies to Diem versions up to and including 5.1.3.

This is a textbook high-CVSS-is-actually-low-risk case - and the CVSS here is not even high. The provided CVSS 4.0 base score is 1.1 (Low), and the vector confirms the weakness is severely constrained: local attack vector (AV:L), high attack complexity (AC:H), requiring low privileges (PR:L), with only low confidentiality impact (VC:L) and no integrity or availability impact. CWE-916 (use of a password hash with insufficient computational effort - here SHA1) is a real cryptographic weakness, but it is not directly exploitable: it only matters once an attacker has ALREADY obtained the stored password hashes, at which point weak hashing makes offline cracking faster. The exploitability signals reinforce low urgency: the input explicitly states 'publicly available exploit code exists' (a POC, reflected by E:P in the 4.0 vector), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or likely widespread exploitation. The VulDB submission is tied to a GitHub issue report to which the project has not responded, indicating no patch. Net: this is a code-quality / defense-in-depth hardening item, not an incident-response priority. The signals are internally consistent (local, high-complexity, low-impact, POC-only), so there is no major conflict to flag - the main caveat is that EPSS/KEV data is absent, which is expected for a very recent, low-severity, obscure-product CVE.

An attacker who already has local, low-privileged access to a Diem installation (or a copy of its database/user table, e.g. via a separate SQL injection, backup leak, or insider access) extracts the SHA1 password hashes stored by PluginDmUser. Because SHA1 is fast and uses insufficient computational effort, the attacker then performs offline brute-force or rainbow-table cracking far more cheaply than against a proper adaptive hash (bcrypt/argon2), recovering plaintext passwords. A public POC exists demonstrating the weakness, but the high attack complexity reflects that the hashes must first be obtained through some other means.