CVE-2026-86183
Received Received - Intake

Authorization Bypass in Diem dmWidget Component

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86183
EUVD
EUVD-2026-72083

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diem-project diem to 5.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the Diem project's dmWidget module. It allows unauthenticated users to access restricted widgets by manipulating the widget_id parameter in public endpoints like /dmWidget/render and /dmWidget/getFull. The flaw occurs because the widget lookup does not verify page security settings or user credentials, enabling access to sensitive content such as private text or media metadata.

Detection Guidance

Check for unauthorized access to the /dmWidget/render and /dmWidget/getFull endpoints by monitoring web server logs for requests to these paths with widget IDs from protected pages. Look for unusual GET requests with widget IDs that should not be publicly accessible.

Impact Analysis

This vulnerability allows attackers to remotely access restricted or private content without authentication. If exploited, it could lead to unauthorized exposure of sensitive data, such as private pages, embedded records, or media metadata, potentially compromising confidentiality and integrity of the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to protected data. GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for protected health information. Exploitation may result in data breaches, violating these regulations and leading to legal penalties or reputational damage.

Mitigation Strategies

Apply the patch 116974edfb9a5b8bd69cb13586dc62bcdbb485ad immediately. Restrict access to the /dmWidget/render and /dmWidget/getFull endpoints by updating server configurations to enforce authentication and authorization checks for these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart