# CVE-2026-86183: Diem CMF authorization bypass in dmWidget endpoints

Source: https://junglewise.ai/threats/cve-2026-86183-diem-cmf-authorization-bypass-in-dmwidget-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86183 · Severity: medium · CVSS 5.3 · Published 2026-09-06

Diem is a content management framework built on Symfony. Two public-facing widget rendering endpoints fail to verify whether a user should have access to the page containing the widget, allowing unauthenticated attackers to view content (text, media, private records) that should only be accessible to logged-in users or users with specific permissions.

Vendors: [Diem-Project](https://junglewise.ai/threats/vendors/diem-project).

## Quick answers

**Is CVE-2026-86183 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86183 being exploited in the wild.

**How severe is CVE-2026-86183?** Medium severity, with a CVSS score of 5.3, published 6 September 2026.

**Which products and versions are affected?** Diem-Project Diem CMF up to 5.1.3.

**Is there a fix for CVE-2026-86183?** A patch was published: Patch commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86183 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86183?** Check whether you run Diem-Project Diem CMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the dmWidget module's public endpoints (+/dmWidget/render and +/dmWidget/getFull). Both actions are configured as non-secure (is_secure: false) and accept a widget_id parameter, but they perform only object ID lookup (findOneByIdWithI18n) without authorizing the owning page. The vulnerable code fails to check the page's is_secure flag, required credentials, active status, or publication state before rendering the widget. An unauthenticated attacker can directly request these endpoints with a known widget ID to retrieve rendered widget content from protected, inactive, or unpublished pages. The patch (116974edfb9a5b8bd69cb13586dc62bcdbb485ad) is available, and public exploits exist.

## Affected products

- Diem Project Diem CMF up to 5.1.3

## Timeline

- 2026-07-19: disclosed: Issue opened on GitHub by ThanatosXingYu
- 2026-09-06: advisory: CVE-2026-86183 published
- patched: Patch commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad available
- exploited: Public exploit exists

## References

- [https://github.com/diem-project/diem/](https://github.com/diem-project/diem/)
- [https://github.com/diem-project/diem/issues/450](https://github.com/diem-project/diem/issues/450)

## Related threats

- [Diem CMF default administrator credentials when database password is empty](https://junglewise.ai/threats/cve-2026-112030-a-vulnerability-was-found-in-diem-project-diem-up-to-5-1-3-this)