CVE-2026-86183: Authorization Bypass in diem-project diem

This vulnerability in diem-project diem up to version 5.1.3 involves improper authorization checks in the dmWidget component, specifically in the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php. By manipulating the widget_id argument, an attacker can bypass authorization mechanisms remotely. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating network attack vector with low complexity and no privileges or user interaction required. A patch identified by commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad is available to remediate the issue, but the vendor has not yet officially responded.

Successful exploitation allows remote attackers to bypass authorization controls in the affected component, potentially granting unauthorized access or actions within the diem software. The vulnerability does not require privileges or user interaction, increasing its risk. However, no active exploitation in the wild is currently known.

Apply the patch identified by commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad to remediate the authorization bypass vulnerability. Since the vendor has not yet responded officially, users should monitor the project for updates and apply the patch promptly to mitigate risk.