CVE-2026-82816: Authorization Bypass in dibo-software diboot

CVE-2026-82816 describes an authorization bypass vulnerability in dibo-software diboot version 3.8.0. The issue affects an unspecified functionality within the /api/ai-session/ endpoint of the AI Session component. Exploitation can be performed remotely without user interaction and requires low privileges. The vulnerability allows attackers to circumvent authorization mechanisms, potentially gaining unauthorized access. The vendor was notified but did not respond, and no official patch or remediation guidance is currently available. The vulnerability has been publicly disclosed, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to bypass authorization controls remotely, potentially gaining unauthorized access to protected resources or functionality within the diboot application. The CVSS score of 5.3 reflects a medium impact, with limited scope and privileges required. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected endpoint and implementing compensating controls such as network-level restrictions or additional authentication layers if feasible.