CVE-2026-78103: CWE-841 in WatchGuard Dimension

WatchGuard Dimension's client-side lock/unlock UI control for management changes is not enforced on the server side. This allows an authenticated administrator to submit configuration changes directly to the server endpoint without completing the UI unlock step. Consequently, an authenticated read-write administrator session can bypass the intended editing workflow and overwrite configuration changes being made by another concurrent administrator session. This issue is identified as CWE-841 (Improper Enforcement of Workflow). The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 base score is 5.1, indicating medium severity. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

An authenticated administrator with read-write privileges can bypass the intended lock/unlock workflow and overwrite configuration changes made by another concurrent administrator session. This could lead to unintended configuration overwrites and potential management conflicts but does not allow privilege escalation or unauthenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should coordinate configuration changes to avoid concurrent edits and monitor administrative sessions carefully.