CVE-2026-86183: diem-project diem dmWidget BasedmWidgetActions.class.php authorization
A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widgetid leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
diem-project diem dmWidgetto a version that resolves this vulnerability.Fixed in 5.1.3Patch 116974edfb9a5b8bd69cb13586dc62bcdbb485ad - Compensating control
Because the authorization bypass may be launched remotely and the exploit is publicly available, restrict network access to the service/component that hosts dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php (for example, limit inbound traffic to trusted sources/IPs) until the patch is applied.
Event History
Frequently Asked Questions
Which deployments are in scope?
diem-project diem installations up to version 5.1.3 are affected where the dmWidget component is present. The affected code is in dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php.
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates no privileges and no user interaction are required. The attack can be launched remotely.
Is public exploit information available?
Yes. The exploit is publicly available and may be used.
What remediation is identified?
Apply the patch identified as 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. No alternative workaround or detection method is provided.