CVE-2026-82816
MediumCVSS 6.3Summary
A vulnerability has been found in dibo-software diboot 3.8.0 in an unknown functionality of the file /api/ai-session/ in the AI Session Endpoint component. Such manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been disclosed to the public.
Risk Assessment
Authorization bypass may allow unauthorized users to access AI sessions, potentially leading to data confidentiality breaches or unauthorized resource usage. The vendor did not respond to the disclosure.
Recommendation
Restrict access to the /api/ai-session/ endpoint and verify authorization mechanisms. Contact the vendor for a patch.
Other vulnerabilities in diboot
See all- CVE-2026-82818Medium
A vulnerability was found in dibo-software diboot 3.8.0 in an unknown part of the file /api/iam/tenant/resource in the Tenant Resource Assignment Handler component. Manipulation of the tenantId argument leads to improper access controls. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-82817Medium
A vulnerability was found in dibo-software diboot 3.8.0 in some unknown functionality of the file /admin/ in the Tenant Administrator Management API component. Manipulation of the tenantId argument results in improper access controls. The attack may be initiated remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.