Eclipse Ditto builds a CreateThing command by inserting header values into a predefined JSON template without applying proper escaping. The placeholder engine does not escape double‑quote characters, so a header supplied by a publishing device can terminate the surrounding string and inject additional JSON objects. This creates a payload that the system parses as a policy object, enabling an attacker to override the configured policyId and assign any access‑control policy to a newly created digital twin. The flaw is rooted in improper handling of user input and concretely corresponds to CWE‑116 and CWE‑1336.

All Eclipse Ditto instances running version 1.3.0 through 3.9.6 that use the ImplicitThingCreationMessageMapper for inbound connections. Vulnerable configurations include connections over MQTT 5, AMQP 1.0, or Kafka where the mapper template reflects a header that the device can control.

The CVSS score of 7.6 indicates a high severity. EPSS is not currently available, so explicit likelihood of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a connection that uses the non‑default mapper, a template that incorporates an attacker‑controllable header, and existence of permission to create policies within that connection’s authorization subjects. If those conditions are met, an attacker can fully read and write the created twin and potentially revoke legitimate owners’ access—all without administrator involvement.