DescriptionDelta Electronics DIAEnergie before 1.11.00.022 contains a missing authorization vulnerability in a user controller action that returns user records by privilege group, allowing any authenticated user to retrieve full user records by exploiting the omitted per-module authorization filter. Attackers can access sensitive data including stored password hashes, email addresses, and phone numbers for all accounts, then crack the disclosed password hashes offline to compromise additional credentials.