CVE-2026-86183: Authorization Bypass in diem-project diem

CVE-2026-86183 is an authorization bypass vulnerability in diem-project diem affecting versions up to 5.1.3. The flaw is located in the dmWidget component, specifically in the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php. Manipulating the widget_id argument allows an attacker to bypass authorization controls remotely without requiring privileges or user interaction. Exploit code is publicly available. Although a patch commit has been identified, the vendor has not officially responded or released a fix yet.

An attacker can remotely bypass authorization controls in the affected component, potentially gaining unauthorized access to functionality or data protected by widget_id checks. The vulnerability does not impact confidentiality, integrity, or availability beyond the authorization bypass itself. No known active exploitation in the wild has been reported.

A patch identified by commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad exists and should be applied to remediate this issue. Since the vendor has not yet officially responded or released a fix, users should monitor the project for an official patch release and apply it promptly once available. Until then, consider restricting access to the vulnerable component if possible.