CVE-2026-82817: Improper Access Controls in dibo-software diboot

This vulnerability affects dibo-software diboot version 3.8.0 in the Tenant Administrator Management API's /admin/ component. Improper access control occurs when an attacker manipulates the tenantId argument, potentially allowing unauthorized access or actions. The vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor was notified but has not provided any response or fix. No official remediation or patch is currently documented.

Successful exploitation could allow an attacker to bypass access controls related to tenant administration, potentially leading to unauthorized access or manipulation of tenant-specific data or functions. The impact is limited to the affected version 3.8.0 and the specific API component. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing additional access control monitoring or compensating controls around the Tenant Administrator Management API if possible. Avoid exposing the /admin/ API endpoint to untrusted networks until a fix is available.