Description
A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-31
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the Tenant Administrator Management API of dibo-software diboot. By manipulating the tenantId parameter in the /admin/ endpoint, an attacker can bypass the intended access controls. This improper validation allows remote users to invoke functions that should be restricted to legitimate tenant administrators, effectively granting unauthorized administrative capabilities.

Affected Systems

The affected product is dibo-software diboot version 3.8.0. The vulnerability appears in the /admin/ component of the Tenant Administrator Management API, which receives the tenantId argument. No other product versions are listed as impacted in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, but the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalogue. The public exploit demonstrates that an attacker can initiate the attack remotely by sending a crafted request to the /admin/ endpoint. Because the vulnerability has been disclosed publicly and the vendor did not respond, the risk of exploitation remains tangible, especially for organizations still running version 3.8.0 without mitigation.

Generated by OpenCVE AI on August 31, 2026 at 20:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade diboot to a version that resolves the tenantId validation flaw.
  • If an upgrade is not immediately possible, restrict the /admin/ endpoint to authenticated administrator accounts and validate the tenantId against the user's session or role.
  • Configure network security controls to limit exposure of the /admin/ API to trusted IP addresses or internal networks.
  • Monitor authentication logs for anomalous access attempts involving the /admin/ endpoint.

Generated by OpenCVE AI on August 31, 2026 at 20:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title dibo-software diboot Tenant Administrator Management API admin access control
First Time appeared Dibo-software
Dibo-software diboot
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:dibo-software:diboot:*:*:*:*:*:*:*:*
Vendors & Products Dibo-software
Dibo-software diboot
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dibo-software Diboot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T18:00:09.717Z

Reserved: 2026-08-31T05:33:11.967Z

Link: CVE-2026-82817

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T18:17:24.650

Modified: 2026-08-31T18:17:24.650

Link: CVE-2026-82817

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T20:15:05Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control