CVE-2026-70559 exposes a critical credential disclosure in Dinky's configuration endpoint. The root cause is a method-level @SaIgnore annotation on SysConfigController.getAll() that silently overrides the class-level @SaCheckLogin, making the endpoint accessible without authentication. This single GET request returns every system configuration value: the dinkyToken, LDAP passwords, OSS access keys, and DolphinScheduler tokens.
The dinkyToken is not a routine credential. It serves as the sole authentication mechanism for POST /download/uploadFromRsByLocal, which permits arbitrary file write to the server filesystem. An attacker with this token can write executable content to web-accessible directories.
Do not attempt to remediate by rotating dinkyToken. The rotation will not work because the new token will also leak from the same unauthenticated endpoint, and the original token remains valid. Rotating creates a compounding problem: you now have two exposed credentials instead of one. This is an unresolvable bind inherent to the vulnerability structure.
Immediate actions: remove the @SaIgnore annotation from getAll() and enforce authentication on that endpoint. Audit any external integrations whose credentials may have been exposed — LDAP, OSS, DolphinScheduler — and treat all of them as compromised. Rotate every credential that flowed through that endpoint. The vulnerability creates a non-revocable credential state: anyone who has already captured the response has permanent access regardless of what you do to the token afterward.