CVE-2026-86183 diem-project diem dmWidget BasedmWidgetActions.class.php authorization
Remote attackers can bypass authorization checks in the diem CMS widget module to access restricted functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86183?
CVE-2026-86183 is a medium-severity missing authorization vulnerability in diem-project diem, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.
Which versions are affected by CVE-2026-86183?
How do I fix CVE-2026-86183?
No fix has been published for CVE-2026-86183 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-86183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86183 exists.
Sources
Also known as GHSA-px86-mrrq-wxm3.