Description

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-06T09:17:16.487Z",
  "pubdate": "2026-09-06T09:17:16.487Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists within the dmWidget component of the diem-project diem framework (up to version 5.1.3).\nThe vulnerability originates from improper handling of the widget_id argument within the BasedmWidgetActions class.\nThis flaw allows remote, unauthenticated attackers to manipulate component parameters, resulting in unauthorized access or actions typically restricted to authorized users.\nThe existence of publicly available exploits increases the risk of successful exploitation, potentially leading to unauthorized data access or integrity compromise within the affected diem instances.\nThe vulnerability stems from a failure to validate user-supplied input against session-based permissions, enabling an attacker to bypass security checks by supplying arbitrary or manipulated widget identifiers.\nGiven that the project has not responded to initial reports, users must independently apply the identified patch to remediate the security risk.\nSystems exposed to the internet are at high risk, as the attack vector does not necessitate complex prerequisites beyond network reachability to the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides in the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php within the dmWidget component. The root cause is a failure in the application's authorization logic, which fails to securely bind a requested action to a validated and authorized user session context.\nSpecifically, the widget_id parameter is accepted via user-supplied input without sufficient server-side verification to ensure the requester possesses the required privileges to interact with the specific widget instance.\nAn attacker can exploit this by intercepting and modifying the HTTP request to the vulnerable action, substituting the legitimate widget_id with an identifier associated with a restricted or sensitive widget.\nThe application processes the malicious request, implicitly trusting the user-provided widget_id, and subsequently executes the action associated with the target widget under the context of the current session, or potentially bypassing authentication checks entirely if the underlying logic assumes the widget belongs to the requester.\nThe attack flow follows a structured path: 1. The attacker identifies an targetable endpoint managed by BasedmWidgetActions. 2. The attacker crafts a request containing a manipulated widget_id parameter. 3. The server-side code in BasedmWidgetActions fails to enforce an access control check against the manipulated parameter, allowing the application logic to proceed with the execution of the requested widget action. 4. The application returns the restricted content or performs the authorized action on behalf of the attacker.\nThis vulnerability is classified as an authorization bypass because the system neglects to verify whether the actor has the authority to manipulate the requested object. The impact is significant, as it grants unauthorized actors the ability to perform operations or view information that should be hidden based on user roles and permissions.\nThe exposure is network-based and can be launched remotely, making it a high-priority threat for public-facing web applications utilizing diem up to 5.1.3.\nPost-exploitation, an attacker may gain unauthorized insights into administrative configurations, trigger unintended state changes, or perform data retrieval that exceeds their legitimate privilege level within the diem ecosystem."
}