CVE-2026-82818
MediumCVSS 6.3Summary
A vulnerability was found in dibo-software diboot 3.8.0 in an unknown part of the file /api/iam/tenant/resource in the Tenant Resource Assignment Handler component. Manipulation of the tenantId argument leads to improper access controls. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
Improper access controls may allow unauthorized users to access tenant resources, potentially leading to data confidentiality breaches. The vendor did not respond to the disclosure.
Recommendation
Restrict access to the /api/iam/tenant/resource endpoint and verify access control logic. Contact the vendor for a patch.
Other vulnerabilities in diboot
See all- CVE-2026-82817Medium
A vulnerability was found in dibo-software diboot 3.8.0 in some unknown functionality of the file /admin/ in the Tenant Administrator Management API component. Manipulation of the tenantId argument results in improper access controls. The attack may be initiated remotely, and the exploit has been made public.
- CVE-2026-82816Medium
A vulnerability has been found in dibo-software diboot 3.8.0 in an unknown functionality of the file /api/ai-session/ in the AI Session Endpoint component. Such manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been disclosed to the public.
Original NVD description (English source)
A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.