Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86183

diem-project diem dmWidget BasedmWidgetActions.class.php authorization

CVSS 4.0 6.9 MEDIUMCVSS 3.1 5.3 MEDIUMCVSS 3.0 5.3 MEDIUMCVSS 2.0 5.0 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86183

Published

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86183

Published

diem

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "diem-project",
                    "product": "diem",
                    "versions": [
                        {
                            "version": "5.1.0",
                            "status": "affected"
                        },
                        {
                            "version": "5.1.1",
                            "status": "affected"
                        },
                        {
                            "version": "5.1.2",
                            "status": "affected"
                        },
                        {
                            "version": "5.1.3",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "dmWidget"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON