CVE-2026-86182
Received Received - Intake

Cross-Site Request Forgery in Diem dmConsole

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86182
EUVD
EUVD-2026-72082

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diem-project diem to 5.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in the Diem project's administrative console plugin. It occurs because the plugin disables Symfony's CSRF protection globally, allowing the console command endpoint to accept a dm_command parameter via GET requests without requiring a form token. This enables attackers to craft malicious pages that execute arbitrary commands on the server when accessed by a logged-in administrator.

Detection Guidance

Check if the dmConsole plugin in Diem is accessible without CSRF protection. Inspect network traffic for GET requests to the console command endpoint containing the dm_command parameter. Review server logs for unusual administrative actions or commands executed by logged-in users.

Impact Analysis

An attacker could trick an administrator into opening a specially crafted link, leading to potential data disclosure, modification, or server-side code execution. This could allow unauthorized access to sensitive information, system compromise, or further attacks within the network.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Enable Symfony's CSRF protection in the dmConsole plugin. Restrict GET requests to the console command endpoint and enforce POST requests with valid CSRF tokens. Update to the latest version of Diem if available. Monitor administrative sessions for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart