CVE-2026-86183

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-285
• CWE-639

• https://github.com/diem-project/diem/
• https://github.com/diem-project/diem/issues/450
• https://vuldb.com/cve/CVE-2026-86183
• https://vuldb.com/submit/896155
• https://vuldb.com/vuln/399315
• https://vuldb.com/vuln/399315/cti

Published

Sep 6, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86177Pterodactyl Panel before 1.14.1 fails to validate action-spe…8.8
• CVE-2026-86178Pixelfed through 0.12.9 fails to validate follower status in…5.4
• CVE-2026-86179A flaw has been found in code-projects Daily Expense Manager…5.3
• CVE-2026-86180A vulnerability has been found in code-projects Task Managem…7.3
• CVE-2026-86181A vulnerability was found in code-projects Task Management S…3.5
• CVE-2026-86182A vulnerability was determined in diem-project diem up to 5.…4.3
• CVE-2026-86184Lara Dashboard before 1.3.0 contains an authentication bypas…9.8
• CVE-2026-86185Bilibili Desktop through 1.18.0 disables TLS certificate ver…8
• CVE-2026-86186AVideo API fails to enforce rate limits when clients send a …6.5
• CVE-2026-86187WWBN AVideo generates passwords for external-login accounts …5.9
• CVE-2026-86188AVideo with YPTSocket plugin enabled contains a cross-site s…7.2
• CVE-2026-86189WWBN AVideo contains a path traversal vulnerability in notif…9.8