CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.
Засегнати продукти
- diem-project diem: 5.1.0; 5.1.1; 5.1.2; 5.1.3
Вид слабост
История
- 6 септември 2026 Публикувано
Други уязвимости в diem-project diem
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-86183
- https://nvd.nist.gov/vuln/detail/CVE-2026-86183
- https://vuldb.com/vuln/399315
- https://vuldb.com/vuln/399315/cti
- https://vuldb.com/cve/CVE-2026-86183
- https://vuldb.com/submit/896155
- https://github.com/diem-project/diem/issues/450
- https://github.com/diem-project/diem/