Executive brief
Diem is a content management framework built on Symfony. Two public-facing widget rendering endpoints fail to verify whether a user should have access to the page containing the widget, allowing unauthenticated attackers to view content (text, media, private records) that should only be accessible to logged-in users or users with specific permissions.
Technical details
The vulnerability is an authorization bypass in the dmWidget module's public endpoints (+/dmWidget/render and +/dmWidget/getFull). Both actions are configured as non-secure (is_secure: false) and accept a widget_id parameter, but they perform only object ID lookup (findOneByIdWithI18n) without authorizing the owning page. The vulnerable code fails to check the page's is_secure flag, required credentials, active status, or publication state before rendering the widget. An unauthenticated attacker can directly request these endpoints with a known widget ID to retrieve rendered widget content from protected, inactive, or unpublished pages. The patch (116974edfb9a5b8bd69cb13586dc62bcdbb485ad) is available, and public exploits exist.
Affected products
- Diem Project Diem CMF up to 5.1.3
Timeline
- 2026-07-19: disclosed: Issue opened on GitHub by ThanatosXingYu
- 2026-09-06: advisory: CVE-2026-86183 published
- patched: Patch commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad available
- exploited: Public exploit exists