Is CVE-2026-86183 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86183 being exploited in the wild.

How severe is CVE-2026-86183?

Medium severity, with a CVSS score of 5.3, published 6 September 2026.

Which products and versions are affected?

Diem-Project Diem CMF up to 5.1.3.

Is there a fix for CVE-2026-86183?

A patch was published: Patch commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86183 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86183?

Check whether you run Diem-Project Diem CMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86183: Diem CMF authorization bypass in dmWidget endpoints

CVE-2026-86183 · Severity: medium · CVSS 5.3 · Published 2026-09-06

Diem is a content management framework built on Symfony. Two public-facing widget rendering endpoints fail to verify whether a user should have access to the page containing the widget, allowing unauthenticated attackers to view content (text, media, private records) that should only be accessible to logged-in users or users with specific permissions.

Vendors: Diem-Project.

Quick answers

Is CVE-2026-86183 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86183 being exploited in the wild.
How severe is CVE-2026-86183?: Medium severity, with a CVSS score of 5.3, published 6 September 2026.
Which products and versions are affected?: Diem-Project Diem CMF up to 5.1.3.
Is there a fix for CVE-2026-86183?: A patch was published: Patch commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86183 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86183?: Check whether you run Diem-Project Diem CMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the dmWidget module's public endpoints (+/dmWidget/render and +/dmWidget/getFull). Both actions are configured as non-secure (is_secure: false) and accept a widget_id parameter, but they perform only object ID lookup (findOneByIdWithI18n) without authorizing the owning page. The vulnerable code fails to check the page's is_secure flag, required credentials, active status, or publication state before rendering the widget. An unauthenticated attacker can directly request these endpoints with a known widget ID to retrieve rendered widget content from protected, inactive, or unpublished pages. The patch (116974edfb9a5b8bd69cb13586dc62bcdbb485ad) is available, and public exploits exist.

Affected products

Diem Project Diem CMF up to 5.1.3

Timeline

2026-07-19: disclosed: Issue opened on GitHub by ThanatosXingYu
2026-09-06: advisory: CVE-2026-86183 published
patched: Patch commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad available
exploited: Public exploit exists

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.