CVE-2026-82817
MediumCVSS 6.3Summary
A vulnerability was found in dibo-software diboot 3.8.0 in some unknown functionality of the file /admin/ in the Tenant Administrator Management API component. Manipulation of the tenantId argument results in improper access controls. The attack may be initiated remotely, and the exploit has been made public.
Risk Assessment
Improper access controls may allow unauthorized administrators to manage tenants, potentially leading to data integrity and confidentiality breaches. The vendor did not respond to the disclosure.
Recommendation
Restrict access to the /admin/ file and verify access control mechanisms. Contact the vendor for a patch.
Other vulnerabilities in diboot
See all- CVE-2026-82818Medium
A vulnerability was found in dibo-software diboot 3.8.0 in an unknown part of the file /api/iam/tenant/resource in the Tenant Resource Assignment Handler component. Manipulation of the tenantId argument leads to improper access controls. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-82816Medium
A vulnerability has been found in dibo-software diboot 3.8.0 in an unknown functionality of the file /api/ai-session/ in the AI Session Endpoint component. Such manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been disclosed to the public.
Original NVD description (English source)
A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.