A flaw exists in the dmWidget component of diem through version 5.1.3; tampering with the widget_id argument supplied in a request allows a remote attacker to bypass the intended authorization, gaining access to widget actions or data that should not be exposed. The weakness conforms to CWE‑285 (Improper Authorization) and CWE‑639 (Authorization Bypass Through User‑Controlled Key). The vulnerability is exploitable remotely and publicly available, meaning that any external actor who can send a crafted request to the application could gain privileged access to widget functionality. This bypass may lead to confidentiality loss or unauthorized data manipulation within the application, potentially compromising sensitive user data or business logic.

The affected product is the diem-project diem software, specifically its dmWidget module up to version 5.1.3. All instances running any 5.x release of diem, including 5.0.x and 5.1.3, are vulnerable. No later versions are known to be impacted.

The CVSS score of 6.9 indicates medium severity. The EPSS score is not available, but the CVE notes that the exploit is publicly available and “might be used”, suggesting a realistic, albeit moderate, likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, implying that an attacker does not need local or privileged access to the host system and can trigger the bypass simply by sending an HTTP request with a manipulated widget_id value.