Description
A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-31
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw exists in dibo-software diboot 3.8.0, specifically in the Tenant Resource Assignment Handler at /api/iam/tenant/resource. By manipulating the tenantId request parameter an attacker can bypass normal tenant boundary checks, gaining unauthorized access to resources that belong to other tenants. This is an authorization bypass through privilege escalation (CWE-266) and improper access control (CWE-284). The flaw allows remote exploitation via a crafted HTTP request, potentially compromising confidentiality and integrity of tenant data.

Affected Systems

Affected installations are those running diboot 3.8.0. The vulnerability is confined to the /api/iam/tenant/resource endpoint; earlier versions have not been reported to contain this issue but no vendor response confirms remediation. Neither additional product versions nor other components are currently listed as affected.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate risk. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The attack can be launched remotely with no privileged credentials or local execution. Because the flaw allows direct manipulation of a request parameter that dictates tenant boundaries, exploitation simply requires sending a crafted HTTP request to the exposed endpoint, making any public-facing diboot instance a potential target until the issue is mitigated.

Generated by OpenCVE AI on August 31, 2026 at 20:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict the /api/iam/tenant/resource endpoint to authorized users only and enforce strict validation of tenantId against the authenticated user's tenant assignment.
  • Deploy network segmentation or firewall rules to limit external access to the diboot management API, ensuring only trusted networks can reach it.
  • When a newer diboot release that addresses the flaw becomes available, upgrade the installation to that version.

Generated by OpenCVE AI on August 31, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title dibo-software diboot Tenant Resource Assignment resource access control
First Time appeared Dibo-software
Dibo-software diboot
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:dibo-software:diboot:*:*:*:*:*:*:*:*
Vendors & Products Dibo-software
Dibo-software diboot
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dibo-software Diboot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T18:48:05.994Z

Reserved: 2026-08-31T05:33:15.998Z

Link: CVE-2026-82818

cve-icon Vulnrichment

Updated: 2026-08-31T18:48:00.678Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T19:17:22.940

Modified: 2026-08-31T20:56:08.800

Link: CVE-2026-82818

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:20:32Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control