EUVD-2026-104032
GHSA-mrh6-j8gm-g89v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain man-in-the-middle network position
-
ExploitPresent forged TLS certificate to gapi client
-
ExecutionCertificate validation bypassed
-
ImpactIntercept or alter Analytics API traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | Requires that the affected Diem instance actively use the Google Analytics Client component (dmCorePlugin/lib/vendor/gapi/gapi.class.php), and that the attacker hold a man-in-the-middle position on the network path between the Diem server and Google's Analytics API endpoint. Limiting factors: high attack complexity (vendor calls exploitability 'difficult'), the need for active traffic interception rather than a direct remote request, impact confined to low integrity of outbound analytics data, and no availability or (per the vector) confidentiality impact. No authentication or user interaction is needed (PR:N/UI:N), but the on-path prerequisite substantially narrows realistic exploitation. |
| Impact | This is a low-priority issue despite its MEDIUM 6.3 rating. The CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N) describes an unauthenticated network attack but with HIGH attack complexity, and the vendor explicitly states exploitability is 'difficult' - consistent with CWE-295 (improper certificate validation), which typically requires an active man-in-the-middle position rather than a directly 'remote' push. Impact is narrow: only VI:L (low integrity), with VC:N and VA:N, so no confidentiality or availability loss is claimed by the source. Exploitation status per input: publicly available exploit code exists (POC=YES), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of real-world exploitation; the referenced 'exploit' is actually a GitHub issue report (github.com/diem-project/diem/issues/454) rather than weaponized code, which weakens the POC signal. SSVC/automatable data is not provided. The CVSS 'Information Disclosure' tag conflicts with the vector's VC:N (no confidentiality impact) - verify the true impact with the vendor. Net: high attack complexity, a tiny/abandoned product footprint, integrity-only impact, and no active-exploitation evidence make this a low real-world risk. |
| Exploit ScenarioDerived | An attacker who can intercept traffic between a Diem-powered site's server and Google's Analytics endpoint (e.g., via a rogue gateway, ARP spoofing, or DNS tampering) presents a forged TLS certificate; because gapi.class.php does not properly validate the certificate, the connection is accepted, letting the attacker tamper with or observe the Analytics API exchange. A proof-of-concept was published via the project's GitHub issue tracker, but exploitation requires an on-path position and is rated high-complexity/difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Improper certificate validation in the Google Analytics Client bundled with the Diem PHP framework (dmCorePlugin/lib/vendor/gapi/gapi.class.php) allows an attacker positioned on the network path between a Diem server and Google's Analytics endpoint to intercept or tamper with outbound analytics traffic without detection. Unauthenticated remote attackers can exploit this, but the attack requires a man-in-the-middle position and the vendor itself describes exploitability as difficult (CVSS 4.0 AC:H); impact is limited to low integrity of analytics data with no availability or confidentiality effect. Publicly available exploit code exists (referenced in diem-project/diem issue #454), and no vendor-released patch has been identified because the project has not responded and ships as a rolling release without versioned artifacts.
RemediationAI
No vendor-released patch identified at time of analysis: Diem is a rolling-release project, the maintainers were notified via issue 454 (https://github.com/diem-project/diem/issues/454) and have not responded, and VulDB records the issue at https://vuldb.com/vuln/421685, so no fixed commit or version number can be cited. Until upstream fixes the vendored library, apply one of these compensating controls: edit dmCorePlugin/lib/vendor/gapi/gapi.class.php to explicitly enforce peer and host verification on outbound calls (CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST set to 2, or the equivalent stream-context verify_peer/verify_peer_name flags) and pin the expected Google CA bundle - the trade-off is that malformed or proxied TLS setups will begin failing and must be corrected; replace the abandoned GAPI client with a maintained library such as google-api-php-client, which requires code changes in the analytics plugin but removes the vulnerable code entirely; if the Google Analytics integration is not in use, remove or disable the Google Analytics Client component so the code path is never executed, accepting loss of analytics reporting. Network-level controls (forcing outbound traffic through a TLS-inspecting egress proxy with strict CA pinning to Google endpoints, or restricting the Diem server's egress to Google's published ranges) reduce MITM exposure but add operational complexity and can break unrelated outbound integrations. Monitor the project repository for an upstream commit that corrects the certificate verification logic and re-apply it promptly.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is the vendored GAPI library (gapi.class.php), a legacy third-party PHP client used by Diem's Google Analytics plugin to make outbound HTTPS calls to Google's Analytics API. The weakness maps to CWE-295 (Improper Certificate Validation): the client's cURL/stream configuration fails to properly verify the peer certificate chain and hostname, so a certificate presented by an intercepting party is accepted as valid. Because Diem is distributed on a rolling-release basis, the flaw exists in the repository at or before commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad rather than in a numbered version, which is why the CPE (cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:*) carries wildcards and no fixed version can be cited. Exploitation is only meaningful where the Google Analytics Client is actually exercised and where the attacker can occupy an on-path (MITM) position - conditions consistent with the high attack complexity and the low integrity-only impact recorded in the independent assessment. The VulDB metadata tags the issue around PHP, Google integration and information disclosure, but the assessed vector (C:L/I:L/A:N, S:U) confirms the practical effect is limited to tampering with or observing outbound analytics data.
Know when Diem gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Improper cert validation enables a high-complexity on-path MITM (AC:H) with no auth (PR:N), allowing both interception (C:L) and tampering (I:L) of Analytics traffic; no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in diem-project diem XSS and Auth Flaws
View all 6Insecure direct object reference (IDOR) in the dmWidget component of diem-project/diem (versions through 5.1.3) allows u
Default-password exposure in Diem CMS through 5.1.3 allows remote attackers to access unhardened installations whose cre
Unrestricted file upload in diem-project/diem through version 5.1.3 exposes the Widget Editor to remote authenticated at
Cross-site request forgery in diem-project/diem up to version 5.1.3 allows remote attackers to trigger unauthorized cons
Path traversal in Diem through 5.1.3 lets an authenticated user with high backend privileges abuse the dmCodeEditor acti
OS command injection in the Diem CMS Administrative Console (diem-project/diem ≤ 5.1.3) allows authenticated administrat
Weak SHA1-based password hashing in the Diem PHP framework's PluginDmUser handler (lib/model/doctrine/PluginDmUser.class
Exploit-DB